stavroslyr / nids Goto Github PK

Creating a NIDS using snort which replays its alerts in a syslog server

I am running my syslog server as host

Steps : for the server :

sudo docker run --privileged -it -P --rm --net=host stavroslir/mysyslogserver /bin/bash

sudo service rsyslog restart

for the client :

sudo docker run -it --privileged --rm -P --net=host stavroslir/myclient /bin/bash

snort -i wlp6s0 -s -c /etc/snort/etc/snort.conf -A fast (I use wifi, if using Ethernet ,use ifconfig to check your enps)

Open 2nd container to create the alert:

sudo docker run -it --rm --net=host myclientsys /bin/bash

wget 8.8.8.8:23456/malicious.exe (we want the destination port to be 23456)

we can close the 2nd container whenever we want

In the first container again

sudo service rsyslog restart

logger -n 127.0.0.1 -f alert -P 514

We will find the alert in our /var/log/messages or /var/log/messages file on the server.

tail -f messages

you can pull my docker images from here: server :https://hub.docker.com/r/stavroslir/mysyslogserver client :https://hub.docker.com/r/stavroslir/myclient

UPDATED!!

I have created 3 bash scripts ,one for each container that when you run them,it does automatically the job for you. You can run them on your own with the following steps:

For the server:

cd /var/log

./myshellscript.sh

For the client:

cd /var/log/snort

./myshellscript.sh

and for the 2nd client that creates the traffic:

cd /var/log/snort

./secclient.sh

NOTE! You should make the Server do the restart first ,or this might not work!

You can run the bash script i have uploaded ,the whole process gets done automatically.