snort学习

首先是编写简单的服务。什么语言都行。就是看怎么部署方便
我这里选择docker
毕竟我主攻的方向为go

docker pull ciscotalos/snort3
docker run --name snort3 -h snort3 -u snorty -w /home/snorty -d -it ciscotalos/snort3 bash
docker exec -it snort3 bash
docker kill snort3

四个靶场

https://www.freebuf.com/articles/web
https://hub.docker.com/r/adamdoupe/wackopicko
https://owasp.org/www-project-webgoat/
https://hub.docker.com/r/vulnerables/web-dvwa/

DDOS模拟

https://ithelp.ithome.com.tw/users/20152505/ironman

首先是python 发送包的软件python scapy
在docker 中使用

docker pull python:3.9.16-bullseye
docker run -it --name=python_scapy python:3.9.16-bullseye /bin/sh
docker exec -it python_scapy /bin/sh

（进入容器后）

pip install --pre scapy[complete]
python --version
scapy -H

(搭建起tcp服务后)
sr1(IP(dst="192.168.1.17")/TCP(dport=9090,flags="S"))
回显
Begin emission:
Finished sending 1 packets.

Received 3 packets, got 1 answers, remaining 0 packets
<IP version=4 ihl=5 tos=0x0 len=44 id=0 flags=DF frag=0 ttl=37 proto=tcp chksum=0xe7ff
src=192.168.1.17 dst=172.17.0.2 |<TCP sport=9090 dport=ftp_data seq=3664159577 ack=1
dataofs=6 reserved=0 flags=SA window=65535 chksum=0x88f2 urgptr=0 options=[('MSS', 1460)] |>>

同时在snrot上编写规则

alert tcp any any -> 192.168.1.17 9090 (msg:"TCP connection attempt"; sid:1000003; rev:1;)

https://github.com/al0ne/suricata-rules
https://rules.emergingthreats.net/open/suricata/rules/
https://github.com/ptresearch/AttackDetection/blob/master/aes.ddos.dofloo/aes.ddos.dofloo.rules