|
← Revision 5 as of 2005-03-01 13:29:56
Size: 9955
Comment:
|
← Revision 6 as of 2005-03-01 13:32:30 →
Size: 1399
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| !'''[http://phentermine1.chat.ru/ Buy phentermine]!'''! | Extrusion detection (aka. ReverseIntrusionDetection) is the process of turning an IntrusionDetectionSystem on it's head so that it watches for "bad" traffic leaving your network instead of bad traffic entering your network. |
| Line 3: | Line 3: |
| !'''[http://0nline-casin0.newmail.ru Online Casino] Win money fast!'''! | See also: ActivePortal, SoftSecurity |
| Line 5: | Line 5: |
| !'''[http://united-airline.boom.ru/ United Airlines tickets] !'''! | Below is a brief how to posted by TerrySchmidt on how he setup up an ExtrusionDetection system on his node: |
| Line 7: | Line 7: |
| [http://online-degree.hotmail.ru/ Online degree] |
1. Grab the latest version of Snort (www.snort.org) currently it is 1.8p1 (however I'm running 1.7) * Grab the latest ruleset from www.snort.org (there are other snort rulesets available, I haven't determined which one best suites this projects needs). * Whittle down the ruleset to just rules that only create True Positives (Not down to an exact since) * Reverse the rules (done in just one place in the Snort configuration file) so that you monitor all traffic coming from your suspected hosts (probably wireless clients) against all the internet hosts. * Set the parameters high enough so you don't get accidental portscan false positives. * Test the setup and monitor the rules for false positives. * After you are satisfied, add Guardian (www.snort.org) which starts blocking IP addresses using IP chains of people triggering alerts. Be careful with the Guardian as you can block legitament hosts, and even yourself if configured improperly. |
| Line 9: | Line 15: |
| [http://online1degree.chat.ru/ Online degree] | (Added by AdamShand) |
| Line 11: | Line 17: |
|
[http://chp-cigar.boom.ru/ cheap cigarettes] [http://disc-cigar.boom.ru/ discount cigarettes] [http://online-cigaret.hotmail.ru/ online cigarettes] [http://marlb-cigar.boom.ru/ marlboro cigarettes] [http://online-cigar.boom.ru/ online cigarettes] [http://winst-cigar.boom.ru/ winston cigarettes] [http://camel-cigar.boom.ru/ camel cigarettes] [http://winst-cigaret.hotmail.ru/ Cheap winston cigarettes] Best links: '''razor scooter''' [http://razor-scooter.hotmail.ru/ | razor scooter] [http://razor2scooter.chat.ru/ | razor scooter] [http://razor-scooter.narod.ru/ | razor scooter] Best links: '''real estate advertising''' [http://re-advertising.boom.ru/ | real estate advertising] Best links: '''retirement community''' [http://retirement1comm.chat.ru/ | retirement community] Best links: '''ring''' [http://titanium-ring.hotmail.ru/ | titanium ring] [http://titanium-ring.boom.ru/ | titanium ring] [http://titanium1ring.chat.ru/ | titanium ring] [http://man-ring.hotmail.ru/ | man ring] [http://man-ring.boom.ru/ | man ring] [http://ring2man.chat.ru/ | man ring] [http://celtic-ring.newmail.ru/ | celtic ring] [http://celtic-ring.boom.ru/ | celtic ring] [http://celtic1ring.chat.ru/ | celtic ring] [http://titanium-ring.newmail.ru/ | titanium ring] [http://titanium-rings.boom.ru/ | titanium ring] [http://titanium4ring.chat.ru/ | titanium ring] [http://man-ring.newmail.ru/ | man ring] [http://man-rings.boom.ru/ | man ring] [http://ring4man.chat.ru/ | man ring] Best links: '''satellite tv''' [http://satellite-tv.hotmail.ru/ | satellite tv] Best links: '''sauna''' [http://sauna-eq.boom.ru/ | sauna equipment] [http://sauna-kit.boom.ru/ | sauna kit] [http://home-sauna.boom.ru/ | home sauna] [http://sauna-room.boom.ru/ | sauna room] [http://sauna-heater.boom.ru/ | sauna heater] Best links: '''school''' [http://home2-school.boom.ru/ | home school] [http://school2home.chat.ru/ | home school] [http://business-school.hotmail.ru/ | business school] [http://business2school.chat.ru/ | business school] [http://law-school.hotmail.ru/ | law school] [http://law2school.chat.ru/ | law school] [http://driving-school.hotmail.ru/ | driving school] [http://driving2school.chat.ru/ | driving school] [http://graduate-schools.hotmail.ru/ | graduate schools] [http://graduate2schools.chat.ru/ | graduate schools] [http://high-school-diploma.hotmail.ru/ | high school diploma] [http://high1school4dipl.chat.ru/ | high school diploma] [http://technical-school.hotmail.ru/ | technical school] [http://technical1school.chat.ru/ | technical school] [http://technical-school.narod.ru/ | technical school] [http://culinary-school.newmail.ru/ | culinary school] [http://culinary1school.chat.ru/ | culinary school] [http://culinary-school.narod.ru/ | culinary school] Best links: '''scooter''' [http://scooter2.hotmail.ru/ | scooter] [http://scooter11.chat.ru/ | scooter] [http://electric-scooter.hotmail.ru/ | electric scooter] [http://electric1scooter.chat.ru/ | electric scooter] [http://motor-scooter.hotmail.ru/ | motor scooter] [http://scooter8.narod.ru/ | scooter] [http://mobility-scooter.hotmail.ru/ | mobility scooter] [http://mobility2scooter.chat.ru/ | mobility scooter] [http://mobility-scooter.narod.ru/ | mobility scooter] [http://electric-scooter.narod.ru/ | electric scooter] [http://wholesale-scooter.hotmail.ru/ | wholesale scooter] [http://wholesale-scooter.narod.ru/ | wholesale scooter] [http://electric-scooter2005.narod.ru/ | electric scooter] [http://motor-scooter.narod.ru/ | motor scooter] [http://motorized-scooter.hotmail.ru/ | motorized scooter] [http://motorizedscooter.chat.ru/ | motorized scooter] [http://motorized-scooter.narod.ru/ | motorized scooter] [http://yamaha-scooter.hotmail.ru/ | yamaha scooter] [http://yamaha2scooter.chat.ru/ | yamaha scooter] [http://yamaha-scooter.narod.ru/ | yamaha scooter] Best links: '''skin''' [http://skin-treatment.boom.ru/ | skin treatment] [http://skin-disease.boom.ru/ | skin disease] [http://skin-treat.boom.ru/ | skin treatment] [http://skin-trt.boom.ru/ | skin treatment] [http://skin1-disease.boom.ru/ | skin disease] [http://skin-treatment.hotmail.ru/ | skin treatment] [http://skin-treatm.boom.ru/ | skin treatment] [http://skin1treatment.chat.ru/ | skin treatment] [http://skin-disease.hotmail.ru/ | skin disease] [http://skin-diseas.boom.ru/ | skin disease] [http://skin1disease.chat.ru/ | skin disease] [http://skin-care-tip.hotmail.ru/ | skin care tip] [http://skin-care-tip.boom.ru/ | skin care tip] [http://skin1tip4care.chat.ru/ | skin care tip] [http://serious-skin-care.hotmail.ru/ | serious skin care] [http://serious-skin.boom.ru/ | serious skin care] [http://dry-skin.hotmail.ru/ | dry skin] [http://dry-skin.boom.ru/ | dry skin] [http://dry1skin.chat.ru/ | dry skin] Best links: '''skin care''' [http://skin-care.hotmail.ru/ | skin care] [http://skin1-care.boom.ru/ | sothys skin care] [http://skin1care.chat.ru/ | skin care] [http://care-skin.boom.ru/ | skin care] [http://care4skin.chat.ru/ | skin care] Best links: '''small business''' [http://mso-sb.boom.ru/ | microsoft office small business] [http://sb-tool.boom.ru/ | small business tool] [http://im-sb.boom.ru/ | internet marketing for small business] [http://sb-owner.boom.ru/ | small business owner] [http://home-based-sb.boom.ru/ | home based small business] [http://sb-server.boom.ru/ | small business server] [http://small--business.boom.ru/ | small home business] [http://sb-consultant.boom.ru/ | small business consultant] [http://sb-accounting.boom.ru/ | small business accounting] [http://sb-development.boom.ru/ | small business development] [http://sb-startup.boom.ru/ | small business startup] [http://sb-credit.boom.ru/ | small business credit] [http://sb-hosting.boom.ru/ | small business hosting] [http://sb-start-up.boom.ru/ | small business start up] [http://sb-franchise.boom.ru/ | small business franchise] [http://sb-finance.boom.ru/ | small business finance] [http://sb-for-sale.boom.ru/ | small business for sale] [http://sb-solution.boom.ru/ | small business solution] [http://sb-web-site.boom.ru/ | small business web site] [http://sb-credit-card.boom.ru/ | small business credit card] [http://sb-web-design.boom.ru/ | small business web design] [http://sb-management.boom.ru/ | small business management] [http://sb-software.boom.ru/ | small business software] [http://sb-resource.boom.ru/ | small business resource] [http://sb-grants.boom.ru/ | small business grants] [http://sb-opportunity.boom.ru/ | small business opportunity] [http://web-hosting-sb.boom.ru/ | web hosting small business] [http://sb-information.boom.ru/ | small business information] [http://sb-idea.boom.ru/ | small business idea] [http://starting-a-sb.boom.ru/ | starting a small business] [http://sb-marketing.boom.ru/ | small business marketing] [http://sb-services.boom.ru/ | small business services] [http://sb-plan.boom.ru/ | small business plan] [http://gg-for-sb.boom.ru/ | government grants for small business] [http://how-start-sb.boom.ru/ | how to start a small business] Best links: '''spyware killer''' [http://spyware-killer.hotmail.ru/ | spyware killer] Best links: '''table lamp''' [http://table-lamp.newmail.ru/ | table lamp] [http://table1lamp.chat.ru/ | table lamp] [http://table-lamp.boom.ru/ | table lamp] Best links: '''tires''' [http://discount-tire.boom.ru/ | discount tire] [http://tire-rack.boom.ru/ | tire rack] [http://tire-dealer.boom.ru/ | tire dealer] [http://goodyear-tire.boom.ru/ | goodyear tire] [http://tire-wheels.boom.ru/ | tire wheels] [http://motorcycle-tire.boom.ru/ | motorcycle tire] [http://michelin-tire.boom.ru/ | michelin tire] [http://atv-tire.boom.ru/ | atv tire] [http://tire-rim.boom.ru/ | tire rim] [http://truck-tire.boom.ru/ | truck tire] [http://car-tire.boom.ru/ | car tire] [http://firestone-tire.boom.ru/ | firestone tire] [http://tire-plus.boom.ru/ | tire plus] [http://goodrich-tire.boom.ru/ | bf goodrich tire] [http://bridgestone-tire.boom.ru/ | bridgestone tire] [http://dunlop-tire.boom.ru/ | dunlop tire] [http://yokohama-tire.boom.ru/ | yokohama tire] [http://nitto-tire.boom.ru/ | nitto tire] [http://continental-tire.boom.ru/ | continental tire] [http://trailer-tire.boom.ru/ | trailer tire] [http://tire-wh-package.boom.ru/ | tire and wheel package] [http://off-road-tire.boom.ru/ | off road tire] Best links: '''titanium''' [http://titanium-band.boom.ru/ | titanium band] Best links: '''titanium band''' [http://titaniumband.boom.ru/ | titanium band] [http://titanium1band.chat.ru/ | titanium band] [http://titanium1band.newmail.ru/ | titanium band] Best links: '''titanium ring''' [http://titanium1-ring.boom.ru/ | titanium ring] Best links: '''travel''' [http://travelagent.chat.ru/ | travel agent] [http://travel2costarica.chat.ru/ | travel to costa rica] [http://cruise1travel.chat.ru/ | cruise travel] [http://italytravel.chat.ru/ | italy travel] [http://travelnursing.chat.ru/ | travel nursing] [http://airlinetravel.chat.ru/ | airline travel] [http://lastminutetravel.chat.ru/ | last minute travel] [http://cheaptravel.chat.ru/ | cheap travel] [http://travelreservatio.chat.ru/ | travel reservation] |
---- [CategoryDocumentation] |
Extrusion detection (aka. ReverseIntrusionDetection) is the process of turning an IntrusionDetectionSystem on it's head so that it watches for "bad" traffic leaving your network instead of bad traffic entering your network.
See also: ActivePortal, SoftSecurity
Below is a brief how to posted by TerrySchmidt on how he setup up an ExtrusionDetection system on his node:
- Grab the latest version of Snort (www.snort.org) currently it is 1.8p1 (however I'm running 1.7)
- Grab the latest ruleset from www.snort.org (there are other snort rulesets available, I haven't determined which one best suites this projects needs).
- Whittle down the ruleset to just rules that only create True Positives (Not down to an exact since)
- Reverse the rules (done in just one place in the Snort configuration file) so that you monitor all traffic coming from your suspected hosts (probably wireless clients) against all the internet hosts.
- Set the parameters high enough so you don't get accidental portscan false positives.
- Test the setup and monitor the rules for false positives.
- After you are satisfied, add Guardian (www.snort.org) which starts blocking IP addresses using IP chains of people triggering alerts. Be careful with the Guardian as you can block legitament hosts, and even yourself if configured improperly.
(Added by AdamShand)