kali linux에서 snort 탐지프로그램 설치
kalilinux에서 터미널을켜서
전부진행한다.
apt-get install -y gcc libpcre3-dev zlib1g-dev libluajit-5.1-dev
apt-get install -y libpcap-dev openssl libssl-dev libnghttp2-dev libdumbnet-dev
apt-get install -y bison flex libdnet autoconf libtool
cd ~
wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz
tar -xvzf daq-2.0.7.tar.gz
cd daq-2.0.7
autoreconf -f -i
./configure && make && make install
cd ~
wget www.snort.org/downloads/snort/snort-2.9.17.tar.gz
cd snort-2.9.17
./configure --enable-sourcefire && make && make install
ldconfig
snort -v (sniffing mode)
snort-2.9.17/local.rules 파일 생성=======================
cd ~
touch snort-2.9.17/local.rules
vi snort-2.9.17/local.rules
집어넣기
alert tcp 192.168.55.29 any -> any any (msg:"test"; sid:0001;)
파일시스템으로가서 /var/log/에 snort라는 폴더를그냥하나만든다
그뒤에
touch /var/log/snort/snort.log.1609979587
snort -q -A console -c /root/snort-2.9.17/local.rules
(아무런반응이나오지않으면된다. 적용한 로컬룰을 탐지할떄 쓰는것)
===========================================