Siber Saldırılara Karşı Aktif Defans Uygulama

Genel Özellikleri

Kurulumu

# wget https://codeload.github.com/drk1wi/portspoof/zip/master
# unzip master.zip
# cd portspoof-master/
# ./configure
# make
# make install

#iptables-restore < system_files/iptables-config

# iptables -LChain INPUT (policy ACCEPT)
target     prot opt source               destination       
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination       
ACCEPT     all  —  anywhere             anywhere          
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

# iptables -L -t natChain PREROUTING (policy ACCEPT)
target     prot opt source               destination       
REDIRECT   tcp  —  anywhere             anywhere             tcp dpts:tcpmux:ftp redir ports 4444
REDIRECT   tcp  —  anywhere             anywhere             tcp dpts:telnet:65535 redir ports 4444
Chain INPUT (policy ACCEPT)
target     prot opt source               destination       
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination 

Genel Kullanımı

# portspoof -h
Usage: portspoof [OPTION]…
Portspoof – service emulator / frontend exploitation framework.
-i   ip : Bind to a particular  IP address
-p   port : Bind to a particular PORT number
-s   file_path : Portspoof service signature regex. file
-c   file_path : Portspoof configuration file
-l   file_path : Log port scanning alerts to a file
-f   file_path : FUZZER_MODE – fuzzing payload file list
-n   file_path : FUZZER_MODE – wrapping signatures file list
-1   FUZZER_MODE – generate fuzzing payloads internally
-2   switch to simple reply mode (doesn’t work for Nmap)!
-D   run as daemon process
-d   disable syslog
-v   be verbose
-h   display this help and exit

/usr/local/etc/portspoof.conf

/usr/local/etc/portspoof_signatures

Portspoof’u servis emulatorü olarak çalıştırmak

# cd /usr/local/etc/
# portspoof -c portspoof.conf -s portspoof_signatures -D
-> Using user defined configuration file portspoof.conf
-> Using user defined signature file portspoof_signatures

Test çalışması

# nmap -sV 85.95.238.172 -v
Starting Nmap 6.40 ( ) at 2013-10-20 04:18 EEST
NSE: Loaded 23 scripts for scanning.
Initiating ARP Ping Scan at 04:18
Scanning 85.95.238.172 [1 port]
Completed ARP Ping Scan at 04:18, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 04:18
Completed Parallel DNS resolution of 1 host. at 04:18, 0.29s elapsed
Initiating SYN Stealth Scan at 04:18
Scanning 172-238-95-85-datacenter-services.ixirtelekom.com.tr (85.95.238.172) [1000 ports]
Discovered open port 22/tcp on 85.95.238.172
Completed SYN Stealth Scan at 04:18, 0.13s elapsed (1000 total ports)
Initiating Service scan at 04:18
Scanning 1 service on 172-238-95-85-datacenter-services.ixirtelekom.com.tr (85.95.238.172)
Completed Service scan at 04:18, 0.01s elapsed (1 service on 1 host)
NSE: Script scanning 85.95.238.172.
Nmap scan report for 172-238-95-85-datacenter-services.ixirtelekom.com.tr (85.95.238.172)
Host is up (0.000097s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.0p1 Debian 4 (protocol 2.0)
MAC Address: 00:0C:29:40:2B:7A (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.65 seconds
           Raw packets sent: 1001 (44.028KB) | Rcvd: 1001 (40.032KB)