Investigating Cyber Attacks With Snort | TryHackMe Snort Challenge -- Live Attacks скачать в хорошем качестве

Investigating Cyber Attacks With Snort | TryHackMe Snort Challenge -- Live Attacks

In this video walk-through, we covered using Snort to investigate and stop cyber attacks. This was part of the online lab room TryHackMe Snort Challenge - Live Attacks. ************* Receive Cyber Security Field Notes and Special Training Videos    / @motasemhamdan   ******* TryHackMe Traffic Analysis Essentials https://tryhackme.com/r/room/traffica... Writeup https://motasem-notes.net/en/investig... ******** Store https://buymeacoffee.com/notescatalog... Patreon   / motasemhamdan   Instagram   / mastermindstudynotes   Google Profile https://maps.app.goo.gl/eLotQQb7Dm6ai... LinkedIn [1]:   / motasem-hamdan-7673289b   [2]:   / motasem-eldad-ha-bb42481b2   Instagram   / mastermindstudynotes   Twitter   / manmotasem   Facebook   / motasemhamdantty   *** 0:01 - Introduction to Snort Challenge on Live Attacks 0:06 - Overview of Brute Force and Reverse Shell Scenarios 1:10 - Setting Up Snort in Sniffer Mode for Packet Capture 2:02 - Explanation of Sniffer and Logger Modes 3:03 - Capturing Traffic to Identify Brute Force Attack 4:04 - Stopping the Capture and Analyzing the Log File 5:05 - Identifying Port and Protocol Under Attack 7:10 - Filtering Traffic to Focus on Ports 80 and 22 8:15 - Analyzing Patterns in SSH Traffic on Port 22 9:52 - Recognizing Potential Brute Force Patterns 10:30 - Final Decision on Port and Protocol (SSH on Port 22) 11:53 - Writing a Snort Rule to Block Brute Force Attempts 12:09 - Explanation of Snort Rules: Log, Alert, and Drop 12:26 - Setting Up Drop Rule for TCP Traffic on Port 22 13:36 - Starting Snort in IPS Mode with Configured Rules 14:35 - Checking for Flag Confirmation After Rule Setup 14:48 - Introduction to Reverse Shell Scenario 15:58 - Detecting Outbound Reverse Shell Traffic 16:04 - Starting Snort to Capture Outbound Reverse Shell Activity 16:50 - Analyzing Traffic for Suspicious Outbound Patterns 17:10 - Blocking Reverse Shell Communications with Snort Rule