Firewall Snort

Firewall
--------
It act as a filter, which prevents malicious things, packets, querries from entering in the network or out going from the network.
		It is just like the filter while we pour tea in the cup. As filter stops tea residue from entering the cup, same way the firewall helps in stoping the malicious content from entering the device.
	Firewall is of both type:
		1. Software
			They are the software which is used inside the same device which is being used by the user. We can configure the inbound (incoming traffic) and outbound (outgoing traffic) as we like to configure.
		2. Hardware
			There are some specific devices, which are very sasta and halka, which works same as that of software firewall but.... they can be places anywhere in the world. They just looks like the router and switches and can look like our CPU.

	Windows Firewall with Advance Security

	Mod Security
		Is is one of the firewall, which can be used as either of the software or as the hardware.


		https://www.digitalocean.com/community/tutorials/how-to-set-up-modsecurity-with-apache-on-ubuntu-14-04-and-debian-8

		cd /etc/apache2/sites-available/
		ls   ---> 000-default.conf
		sudo nano 000-default.conf
			--->	ProxyPass / http://172.16.79.159/
	        --->	#to send request to IP 172.16.79.159
    	    --->	ProxyPassReverse / http://172.16.79.159/
        	--->	#To get the response from 172.16.79.159
        sudo service apache2 restart

IPS --> Instusion Prevention System
		When My IDS detects the intrusion, this IPS start taking precautions as per feeded what to do by the user.

IDS --> Instusion Detection System
		When some one tries to intrude into my system, them IDS start its working and Detects the intrusion and makes an alert. so that required steps could be taken on time.


When AVAST antivirus scans the file, if it detects any malicious file, then it makes an alarm --> "WArning a virus has been detected"... Then it asks for the coutermeasure to take.
			"Delete this file"
			"Quarantine it for 45 days"


IPS & IDS
		-----> SNORT

wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz

wget https://www.snort.org/downloads/snort/snort-2.9.11.tar.gz

tar xvfz daq-2.0.6.tar.gz

cd daq-2.0.6
./configure && make && sudo make install

tar xvfz snort-2.9.11.tar.gz

cd snort-2.9.11
./configure --enable-sourcefire && make && sudo make install


Log Analysis
=============

IP AuthenticationName TimeStamp RequestURL 200|404 BYtesTransfered ReferalURL UserAgent


127.0.0.1 - - [08/Aug/2017:17:22:03 +0530]  "GET /dvwa/ HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"


127.0.0.1 ---> IP to which we are visiting

[08/Aug/2017:17:22:03 +0530] --> Date and time at which log is been generated

"GET /dvwa/ HTTP/1.1" ---> Which request + sub folder/sub directory/path HTTP Version

302 --> Request error
		1xx Informational responses
		2xx Success
		3xx Redirection
		4xx Client errors
		5xx Server errors

"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"





127.0.0.1 - - [08/Aug/2017:17:22:03 +0530] "GET /dvwa/dvwa/js/dvwaPage.js HTTP/1.1" 200 775 "http://127.0.0.1/dvwa/setup.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"


775 --> Packet Size which is being sent



172.16.79.132 - - [30/Oct/2017:11:30:50 +0530] "GET /dvwa/vulnerabilities/sqli/?id=1%27+/*!50000union*/+/*!50000select*/%201,/*!50000table_name*/%20from%20/*!50000information_schema.tables*/--+&Submit=Submit HTTP/1.1" 200 36981 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0"


Proxychain to evade detection in kali linux
https://codingsec.net/2016/05/use-proxychains-evade-detection-kali-linux/