1. Big brother is watching you Stefan FODOR(backb0ne fl00d3r ) Lucky-Day from May Log

3. Example..

4. Iptables and logs

5. Introducing snort

6. Live Demo?

7. Question?

9. Warning

10. Errors

12. Code

13. Error/warning message

15. Trace errors

16. Check for intrusions

17. Statistics

18. /var/log

19. /var/log Kernel Logs Log, warn, err dmesg Web server apt logrotate

20. For the untrained eyes

21. For the trained eyes File dependency – legit request Legit request SQL injection? ?

23. Store iptables logs to /var/log/iptables.log

24. $ nmap 192.168.1.20

25. Nmap and iptables

27. Set rules for nmap

28. Configured log file

29. BASE “interface”

30. Run nmap

31. Regular Nmap Scan

32. Stealth Scan + OS Det

33. Live Demo? (As needed)

34. Questions?