[Autogenerated] speaking of demos,
let's hop right into it and explore that application.
Pre processor, we'll see the configurations then watch it work its magic.
Alright.
And we're back in the lab.
The final pre processor that we're gonna talk about in this
module is going to be the application.
Pre processors and we covered a lot of the
information surrounding that just now.
So let's check it out and see what kind of
capabilities this pre processor gives us.
Alright.
So the first one we're gonna do is look at the snort dot lua
file and look at the configurations for the application and
let's go ahead and do more instead.
So all of these pre processors right here are different application.
Pre processors we have ones for things like ftp,
we have the ssh and telnet and ssl Pre processors we have
DNS ones we have some ftp settings and some smtp settings
to help those application.
Pre processors along.
And so these Pre processors help us extract and process all the
information needed for those applications that are defined.
So all of this poor configuration and address or network configuration.
All feeds into snort and how it behaves how it operates the application.
Pre processors are really cool because it helps us create rules and
identify specific criteria to allow us to identify malicious activity or
potentially malicious activity in the applications.
As you can see there's a lot defined here under ftp,
in the snort defaults dot lua One of the ways we can use the application.
Pre processors is to identify either specific
connections or specific commands used,
you know with the protocols so to be able to start this,
we have to edit our snort dot lua file so let's hop into there now,
since this is just the standard snort dot lua file,
we're going to use one of the built in plugins that comes with
snort which is the app IDE this is gonna get us started with
detecting the different applications that we see in the network and
being able to inspect them properly.
This configuration should already be in there.
If you installed it with defaults,
all we're gonna do is uncommenting it and save and then exit now
with this we'll go ahead and restart it to make sure that the new
configuration takes effect and it looks like we have a
configuration failure of some sort,
let's go ahead and hop back into the configuration file and see
what's going on with that uh ha Now if you look here,
I made a huge mistake,
don't get too excited when you're doing configurations and
forget to actually finish the configurations.
So now we have the app detector directory that's going to contain all of
the path information for where the app I D s are located,
that's what should be in here.
This is the path for the app IDE configuration rules and everything like that.
Now let's save it.
Okay, so our problem is I tried to turn on the app IDE detection,
plugin and it didn't work because it can't access that mapping
data so we have to download it and install it.
Alright, now that that's good.
We should be alright to start start again and there we go.
It's running let's go ahead and create a quick rule to detect a specific
application and let's use something like Twitter as an example.
So let's modify our local rules.
All right.
And now that we have that rule created,
we're just gonna do a test to see if we can detect activity for users
going to twitter dot com and let's restart snort alright.
And it's still running now let's go ahead and just use w get to go to
twitter dot com and count our logs and as you can see now snore is detecting
any sort of twitter traffic and coming up with the message who's using
Twitter so it detected the application inside of the conversation that was
going on between itself and Twitter and with that it's time to wrap up the
pre processor conversation.
It was great to be able to see those in action.
We started out this module by talking about the h g d p
inspect pre processor and how it works.
We saw the configuration for this in the lab and
demonstrated its usage a little bit.
We then detailed the ports can pre processor and saw its usage with the snort
rule and we just got finished discussing the application.
Pre processors and what you can do with the power of app IDE It's important to
keep in mind that the pre processors are highly configurable,
so take a look at the documentation here.
What you saw throughout this module was only three of them out of
the many that are out there and you can go deep into their
configurations and customizations Coming up next,
we're going to dive into a discussion about adding additional
capabilities to snort using plugins We'll focus a bit more on the
application pre processor in that one as well.
Join me in the next module.