Download Network Penetration Using Nmap and SNORT

1. Introduction  Project Overview The purpose of this project is to utilize a port scanning application, NMap, to find open ports and/or potential vulnerabilities on another target PC. Concurrently, while the ‘attacker’ PC is scanning the target for vulnerabilities, the virtualized Intrusion Detection System (IDS) will be monitoring all inbound and outbound network traffic through a bridged network connection on the Hosting PC (Target). The IDS on the virtualized PC shall attempt to detect these scans with another application called SNORT with customized detection rules. The Intrusion Detection System (IDS) looks for attack signatures, which are specific prototypes that usually indicate malicious or suspicious intent. This project shall demonstrate the use of SNORT, which is an open source network intrusion prevention and detection system utilizing a rule‐driven language, to detect and react to ping attacks from the Attacker PC. In the event of an intrusion attempt, the IDS will utilize a MySQL database which provides a mechanism to store and later query alerts that are generated by SNORT. 1.1.1 Project Resources The software resources listed below were taken from their respective user installation manuals and are listed as required dependencies. The following resources were used in the creation of this project: o Nmap software (http://nmap.org) o Zenmap GUI frontend for Nmap (NMap) o SNORT software (http://snort.org) o Virtualization software‐ Oracle VirtualBox o Snort‐MySQL with all updated packages (SNORT IDS) Page | 2