WEBVTT 00:00:01.020 --> 00:00:02.250 [Autogenerated] speaking of demos, 00:00:02.430 --> 00:00:05.860 let's hop right into it and explore that application. 00:00:05.860 --> 00:00:10.750 Pre processor, we'll see the configurations then watch it work its magic. 00:00:11.760 --> 00:00:12.510 Alright. 00:00:12.520 --> 00:00:14.190 And we're back in the lab. 00:00:14.200 --> 00:00:17.700 The final pre processor that we're gonna talk about in this 00:00:17.700 --> 00:00:19.280 module is going to be the application. 00:00:19.280 --> 00:00:21.900 Pre processors and we covered a lot of the 00:00:21.900 --> 00:00:23.830 information surrounding that just now. 00:00:23.840 --> 00:00:26.680 So let's check it out and see what kind of 00:00:26.680 --> 00:00:29.550 capabilities this pre processor gives us. 00:00:30.590 --> 00:00:31.220 Alright. 00:00:31.230 --> 00:00:34.650 So the first one we're gonna do is look at the snort dot lua 00:00:34.650 --> 00:00:40.200 file and look at the configurations for the application and 00:00:40.210 --> 00:00:42.700 let's go ahead and do more instead. 00:00:43.350 --> 00:00:47.520 So all of these pre processors right here are different application. 00:00:47.520 --> 00:00:51.460 Pre processors we have ones for things like ftp, 00:00:51.460 --> 00:00:56.070 we have the ssh and telnet and ssl Pre processors we have 00:00:56.070 --> 00:01:00.940 DNS ones we have some ftp settings and some smtp settings 00:01:00.950 --> 00:01:02.500 to help those application. 00:01:02.500 --> 00:01:03.900 Pre processors along. 00:01:04.530 --> 00:01:09.960 And so these Pre processors help us extract and process all the 00:01:09.960 --> 00:01:13.080 information needed for those applications that are defined. 00:01:13.600 --> 00:01:18.760 So all of this poor configuration and address or network configuration. 00:01:18.760 --> 00:01:23.860 All feeds into snort and how it behaves how it operates the application. 00:01:23.860 --> 00:01:28.090 Pre processors are really cool because it helps us create rules and 00:01:28.090 --> 00:01:33.140 identify specific criteria to allow us to identify malicious activity or 00:01:33.140 --> 00:01:35.920 potentially malicious activity in the applications. 00:01:37.590 --> 00:01:41.340 As you can see there's a lot defined here under ftp, 00:01:41.350 --> 00:01:48.200 in the snort defaults dot lua One of the ways we can use the application. 00:01:48.200 --> 00:01:51.460 Pre processors is to identify either specific 00:01:51.460 --> 00:01:54.360 connections or specific commands used, 00:01:54.370 --> 00:01:59.070 you know with the protocols so to be able to start this, 00:01:59.080 --> 00:02:04.020 we have to edit our snort dot lua file so let's hop into there now, 00:02:04.030 --> 00:02:07.080 since this is just the standard snort dot lua file, 00:02:07.340 --> 00:02:11.200 we're going to use one of the built in plugins that comes with 00:02:11.200 --> 00:02:15.460 snort which is the app IDE this is gonna get us started with 00:02:15.470 --> 00:02:18.940 detecting the different applications that we see in the network and 00:02:18.940 --> 00:02:21.020 being able to inspect them properly. 00:02:21.030 --> 00:02:23.780 This configuration should already be in there. 00:02:23.790 --> 00:02:25.460 If you installed it with defaults, 00:02:25.470 --> 00:02:31.230 all we're gonna do is uncommenting it and save and then exit now 00:02:31.240 --> 00:02:34.380 with this we'll go ahead and restart it to make sure that the new 00:02:34.380 --> 00:02:38.960 configuration takes effect and it looks like we have a 00:02:38.960 --> 00:02:40.930 configuration failure of some sort, 00:02:40.930 --> 00:02:44.540 let's go ahead and hop back into the configuration file and see 00:02:44.540 --> 00:02:48.840 what's going on with that uh ha Now if you look here, 00:02:48.850 --> 00:02:50.090 I made a huge mistake, 00:02:50.100 --> 00:02:54.420 don't get too excited when you're doing configurations and 00:02:54.420 --> 00:02:56.600 forget to actually finish the configurations. 00:02:57.430 --> 00:03:02.700 So now we have the app detector directory that's going to contain all of 00:03:02.700 --> 00:03:05.860 the path information for where the app I D s are located, 00:03:07.170 --> 00:03:08.220 that's what should be in here. 00:03:08.220 --> 00:03:12.650 This is the path for the app IDE configuration rules and everything like that. 00:03:13.250 --> 00:03:14.370 Now let's save it. 00:03:14.380 --> 00:03:19.720 Okay, so our problem is I tried to turn on the app IDE detection, 00:03:19.720 --> 00:03:23.530 plugin and it didn't work because it can't access that mapping 00:03:23.530 --> 00:03:26.450 data so we have to download it and install it. 00:03:26.970 --> 00:03:29.350 Alright, now that that's good. 00:03:29.400 --> 00:03:35.290 We should be alright to start start again and there we go. 00:03:35.300 --> 00:03:41.280 It's running let's go ahead and create a quick rule to detect a specific 00:03:41.280 --> 00:03:44.900 application and let's use something like Twitter as an example. 00:03:45.090 --> 00:03:47.280 So let's modify our local rules. 00:03:51.220 --> 00:03:51.790 All right. 00:03:51.800 --> 00:03:53.270 And now that we have that rule created, 00:03:53.270 --> 00:03:57.960 we're just gonna do a test to see if we can detect activity for users 00:03:57.960 --> 00:04:02.230 going to twitter dot com and let's restart snort alright. 00:04:02.230 --> 00:04:07.210 And it's still running now let's go ahead and just use w get to go to 00:04:07.210 --> 00:04:13.880 twitter dot com and count our logs and as you can see now snore is detecting 00:04:13.890 --> 00:04:18.420 any sort of twitter traffic and coming up with the message who's using 00:04:18.420 --> 00:04:23.300 Twitter so it detected the application inside of the conversation that was 00:04:23.300 --> 00:04:30.340 going on between itself and Twitter and with that it's time to wrap up the 00:04:30.340 --> 00:04:32.130 pre processor conversation. 00:04:33.080 --> 00:04:35.440 It was great to be able to see those in action. 00:04:35.960 --> 00:04:39.090 We started out this module by talking about the h g d p 00:04:39.090 --> 00:04:41.690 inspect pre processor and how it works. 00:04:42.390 --> 00:04:45.310 We saw the configuration for this in the lab and 00:04:45.310 --> 00:04:47.220 demonstrated its usage a little bit. 00:04:48.150 --> 00:04:52.810 We then detailed the ports can pre processor and saw its usage with the snort 00:04:52.810 --> 00:04:56.770 rule and we just got finished discussing the application. 00:04:56.770 --> 00:05:02.430 Pre processors and what you can do with the power of app IDE It's important to 00:05:02.430 --> 00:05:06.340 keep in mind that the pre processors are highly configurable, 00:05:06.410 --> 00:05:08.930 so take a look at the documentation here. 00:05:09.510 --> 00:05:13.920 What you saw throughout this module was only three of them out of 00:05:13.920 --> 00:05:16.950 the many that are out there and you can go deep into their 00:05:16.950 --> 00:05:20.540 configurations and customizations Coming up next, 00:05:20.770 --> 00:05:24.200 we're going to dive into a discussion about adding additional 00:05:24.200 --> 00:05:29.000 capabilities to snort using plugins We'll focus a bit more on the 00:05:29.010 --> 00:05:31.640 application pre processor in that one as well. 00:05:31.890 --> 00:05:34.230 Join me in the next module.