Analyzing HTTP and FTP Traffic with Snort | TryHackMe Snort Challenge - The Basics

[@jonand123]

I get the correct answer in the first question by using these two rules alert tcp any any any 80 (msg: "port 80 traffic"; sid: 100001; rev: 1;) alert tcp any 80 any any (msg: "port 80 traffic"; sid: 100002; rev: 1;) Thank you for good videos!

[@wolfiexii]

Dude, lifesaver. Thank you for this comment.

[@fallondavenport2448]

I found this to be correct. The origianl snort room did only use the bidirectional operators so that makes sense too. Thank you

[@samas69420]

but why the double single arrow doesnt work? and also do you get the same number number using only one rule with bidirectional arrow? from what i do understand the first rule you used with bidirectional arrow should match the same packets as the second one, and it should be also the same as two rules with single arrows where you put the port number in the source for one rule and in the dest for the other rule

[@Anoosh192]

Answers?

[@f4yd4-s3c2]

hi for the quesion 3,4,5 you must try to put every ack,sed or ttl number founed 3 ACK = 0x38AFFFF3 4 SEQ = 0x38AFFFF3 5 ttl = 128

[@wolfiexii]

Dude... Thank you!

[@m58954]

lifesaver

[@arjunmishra1004]

thanks dude i tried to find but i stuck for a hour

[@TheFreezingTuberJosh]

For both the rules for Inbound and Outbound port 80, Replacing "->" with "" seems to give the correct packet number

[@null.ru.1337]

Josh is correct, making it bi-directional, got all the answers.

[@mrdinkh3209]

@@null.ru.1337 Yes Bi-directional seems to capturing all of the packets.

[@trippleCS]

yep seems like making it one way only gave you half

[@wabisabi84]

- This video was made in April of 2022, today is 2024. -The ask has been changed ever since from in most tasks. For example in the HTTP task it said, Write rules to detect "all TCP..." to, Write a single rule to detect "all TCP..." -That said, as of today, one of the correct rules to use is (remove ). -To answer the question that reads, "What is the destination address of packet 63?" I used the bash command, (remove the ) This showed me up to 65 alerts*. From there I was able to easily answer the questions. Mr. Hamdan, said it right, remember which is your source and destination IP address. Thank you for your hard work Mr. Hamdan.

[@MotasemHamdan]

I didn't know they made changes on the room. I will check them out. Thank you !

[@wabisabi84]

@@MotasemHamdan You called it out correctly about THM needing to be more specific. They later addressed this by updating the ask. I learned some work arounds thanks to you.

[@korabkanwar6784]

hey bro.I used these rues but still I'm getting wrong answers...can u please send me the correct answers for HTTP rules

[@wabisabi84]

@@korabkanwar6784 I don't know where you got stuck so I'll try to coach as best as I can from here. More importantly, try using AI to breakdown the commands and ask to explain each piece of the command(s). It helped me put things together along with videos like this. 1) Drill into TASK-2 (HTTP) command --> cd Desktop/Exercise-Files/'TASK-2 (HTTP)' 2) ls and you'll see local.rules and mx-3.pcap, so use command --> nano local.rules 3) Set this rule save and exit. Rule --> alert tcp any 80 any any ( msg:"Detect all TCP port 80 traffic"; sid:100005; rev:1; ) 4) Run this command --> sudo snort -c local.rules -r mx-3.pcap -l . 5) You'll get your first answer just like Mr. Hamdan shows. 6) Use command ls and you'll see the snort.log.(numbers) thanks to the earlier command by adding" -l . " That said, since the task is only asking questions of the first 65 packets we can use this command --> sudo snort -r snort.log.######## -n 65 this will show you only 65 packets instead of the 164. 7) The answer to question 2 is in the video. For question 3, I had the same Ack that Mr. Hamdan had when I paused the video regarding Ack# for package 64, and the answer was accepted on my end, he must've had a typo. If you get questions 1, 2, and 3 correct, then you only need to read the remaining questions carefully. No further commands are necessary after answering question 3. You can use commands if you want, but they are not required. Good luck! Remember, read to get an understanding of each piece of the commands. This will help future tasks.

[@korabkanwar6784]

@@wabisabi84 thanks a lot! I got it done correctly yesterday but I forgot to delete the commmet. Thanks for helping!!

[@HowardNguyen-l6g]

dumb question but how do you close the file @7:34

[@Hinksmn]

idk either

[@jeehill9592]

I think the issue you're running into is using unilateral arrows (->) i used bilateral arrows on my rules () and got the correct counts on packets. Hope this helps

[@fallondavenport2448]

This helped thanks

[@JAWbreaker316]

Can you explain why the single arrow fails, even with two rules being written that indicate the source and destination? Is it because the traffic has to go both ways for it to be recognized? I'm still learning and need help understanding why the ->isn't effective

[@jeehill9592]

​​@@JAWbreaker316I wish I knew specifically why creating 2 rules with each screening for inbound vs outbound was wrong. I dont think it would be wrong in the context of writing rules for effectiveness however its the specific nature of the exercise that makes it different.

[@JAWbreaker316]

​@jeehill9592 thats why I'm confused too. At first I thought it had something to do with TCP 3 way handshake, and for it to work due to the protocol, data has to pass sync, syn+ack and ack for the packet data to be detected? I'm still learning so I may be wrong but because it's TCP.....then again, all the data is coming from a pre existing .pcap file so that shouldn't matter since it's basically using Snort to do an archive review.....idk.

[@jeehill9592]

@@JAWbreaker316 the TCP 3 way handshake should be captured by 2 rules using inbound/outbound flags since the packets are still only capable of going 1 way per packet. I think its like you said since its a pcap review it has some oddities

[@recepguner6464]

Use the given pcap file. Write rules to detect "all TCP port 80 traffic" packets in the given pcap file. What is the number of detected packets? answer is 164x2= 328

[@nelsoncorreia7293]

It rejects the answer 328 and it drives me insane.

[@joeymochoeneng8246]

@@nelsoncorreia7293 me too, did you find whats wrong?

[@Hinksmn]

at 7:30 what did you press to close the GNU Nano idk how to close it

[@smzaman111]

rule should be only >>>>> alert tcp any any any 80 (msg:”TCP port 80 found”; sid:100002; rev:1;) then you will get all the correct answer. I tried with different rule and then get all the result correct. because in the question it clearly says, rule should be SINGLE and not TWO rule. [Hint:Make sure to only use a single rule, or you potentially get wrong results for the next questions]

[@timothypotts3913]

Command I used just recently for the first question seemed to have worked alert tcp any 80 any any (msg:"TCP port 80 traffic detected";sid:1000000000001; rev :1)

[@jesstergoober]

I wasn't able to get the correct answer either on Task 3: Question 1. I also got 307. Did you ever figure out that answer? I noticed it was left blank at the end of the video. Thanks! Great videos!

[@cloudhobbyist]

Answer is 614.

[@mariuszpaliwoda9833]

Could you describe task 2 and 3? In another video, I saw that you got done.

[@nexusgraphics300]

hey man, can you please share the answer for the first question to both "writing ids rules http" and "writind ids rules ftp" with the number of detected packets for port 80 and 21 please ?

[@arjunmishra1004]

hey sir can i get your few notes about blue teaming.

[@planetdrinker5385]

Task 3 question 1 answer alert tcp any 21 any any (msg: "FTP packet found"; sid: 100001; rev:1) alert tcp any any any 21 (msg: "FTP packet found"; sid: 100002; rev:1)

[@papijelly]

Theres definitely something wrong with this module. The answer for task 3 Q1 is 614. The firs ttime i tried i fort this number and it would not take it. I aplyed around with the rule and some others #s wich none work. After I fixed it and got 614 again try to answer the question and now irt aceppted it. i had the sames issues you had in task 2

[@johnvardy9559]

hey mohamed could you share your notes with us?

[@MotasemHamdan]

Hello, notes are part of channel membership below kzbin.info/door/NSdU_1ehXtGclimTVckHmQjoin

[@ziyangfeng2486]

I think you rules are correct. Let's say we had two bio-direction rules A: alert tcp any any any 80 (msg: "port 80 traffic"; sid: 100001; rev: 1;) B: alert tcp any 80 any any (msg: "port 80 traffic"; sid: 100002; rev: 1;) we had User A 192.168.1.1 sent a http request and the server 192.168.1.2 replied to the User A The flow would be 192.168.1.1 12345 -> 192.168.1.2 80 192.168.1.2 80 -> 192.168.1.1 12345 My assumption is that, a bio-direction rule generates two alerts. this flow hit the rule A twice, and generated 2 alerts. this flow hit the rule B twice, and generated 2 alerts. so even there are only 2 packets in the flow. When we look at the action stats, we are actually looking at the number of alerts generated.

[@fallondavenport2448]

I can't seem to get the correct asnwer for ACK number of packet 64 or the SEQ number for packet 62... anyone else have luck?

[@fallondavenport2448]

the answer I found online for ACK 64 packet is "0x38AFFFF3" but in my snort log packet 64 ACK is "0x2E6B5384"

[@fallondavenport2448]

OKAY now I realize that what you shoudl do is delete the old logs. Edit your rules to use the bidirectional operator and make sure when you run snort that your reading the new log! Then all the answers shsould be easily found.

[@MotasemHamdan]

Glad you made it on your own :)

[@aryadas879]

​@@fallondavenport2448 can you tell what's the seq number of packet 62 in this case.. I'm struggling a lot

[@mzmlzadjali3644]

@@fallondavenport2448 hi bro can u write for me the seq number of packet 62?

[@planetdrinker5385]

I could only get Task 3 question 3 to work for me when I used "530" and not "530 USER"

[@joe_B12]

You have to write those rules you have with direction and then the first answer is 328

[@MotasemHamdan]

Tried this as well and were getting the same number: 164

[@joe_B12]

​@@MotasemHamdan Something in your rule is not set to scan both ways. You have 164 with is only one direction. When I add to both rules as in your case, it works fine.

[@ian230187]

@@MotasemHamdan : Hello brother....set up the rule bidirectionally such that you have msg, sid and rev number only....check if you get the answer

[@nazeerhussain3364]

I found the Answer for the TASK 2 it is 164

[@ozellb5760]

The number 164 is only half correct. The alert only grabs half. The answer is 328, just double the number shown for alerts.

[@extremoleste8310]

Friend makes CTFS that are free 🙏🙏🙏🙏🙏

[@cihanozcan7]

task 2 number of packages 328, you have to look both ways. alert tcp any any any 80 (msg:"http packet found::";sid:100001;rev:1;) alert tcp any 80 any any (msg:"http packet found::";sid:100002;rev:2;)

[@danielcardenas721]

Motasem, thanks for your guide, im a really big follower of you and your videos, your explanations help me a lot during last month i decide to go into CyberSecurity with THM. Hope one day will be able to be a Patreon!!!! If you are stuck with the issues this work for me! Rules: alert tcp any any any 80 (msg: "port 80 traffic"; sid: 100001; rev: 1;) alert tcp any 80 any any (msg: "port 80 traffic"; sid: 100002; rev: 2;) Checking logs: sudo snort -r (check the files and try with the Snort.log available if you have two or more try with each one!) -n 65

[@firstnamelastname2948]

your rules are incorrect