Results 1 to 6 of 6

Thread: Pytbull in Backtrack

Hybrid View

  1. #1
    Just burned his ISO
    Join Date
    May 2011
    Posts
    2

    Default Pytbull in Backtrack

    Hi,

    I am the author of pytbull (http://pytbull.sourceforge.net), and IDS/IPS Testing Framework, written in Python.

    pytbull is an Intrusion Detection/Prevention System (IDS/IPS) Testing Framework for Snort, Suricata and any IDS/IPS that generates an alert file. It can be used to test the detection and blocking capabilities of an IDS/IPS, to compare IDS/IPS, to compare configuration modifications and to check/validate configurations.

    The framework is shipped with about 300 tests grouped in 9 testing modules:

    - clientSideAttacks: this module uses a reverse shell to provide the server with instructions to download remote malicious files. This module tests the ability of the IDS/IPS to protect against client-side attacks.
    - testRules: basic rules testing. These attacks are supposed to be detected by the rules sets shipped with the IDS/IPS.
    - badTraffic: Non RFC compliant packets are sent to the server to test how packets are processed.
    - fragmentedPackets: various fragmented payloads are sent to server to test its ability to recompose them and detect the attacks.
    - multipleFailedLogins: tests the ability of the server to track multiple failed logins (e.g. FTP). Makes use of custom rules on Snort and Suricata.
    - evasionTechniques: various evasion techniques are used to check if the IDS/IPS can detect them.
    - shellCodes: send various shellcodes to the server on port 21/tcp to test the ability of the server to detect/reject shellcodes.
    - denialOfService: tests the ability of the IDS/IPS to protect against DoS attempts
    - pcapReplay: enables to replay pcap files
    It is easily configurable and could integrate new modules in the future.

    There are basically 6 types of tests:

    - socket: open a socket on a given port and send the payloads to the remote target on that port.
    - command: send command to the remote target with the subprocess.call() python function.
    - scapy: send special crafted payloads based on the Scapy syntax
    - multiple failed logins: open a socket on port 21/tcp (FTP) and attempt to login 5 times with bad credentials.
    - client side attacks: use a reverse shell on the remote target and send commands to it to make them processed by the server (typically wget commands).
    - pcap replay: enables to replay traffic based on pcap files

    External links:
    - Download: https://downloads.sourceforge.net/pr...ll-1.3.tar.bz2
    - Official documentation: http://pytbull.sourceforge.net/?page=documentation
    - Demonstration video: http://www.youtube.com/watch?v=_zS1f-F9niw
    - Online slides: https://docs.google.com/viewer?a=v&p...NmJjZjUz&hl=en

    Since many security professionals like the tool, I'm sure it will be a good idea to include it in BackTrack. Here are some references:
    - PentestIT: http://www.pentestit.com/2011/04/30/...ing-framework/
    - Darknet.org.uk: http://www.darknet.org.uk/2011/05/py...ing-framework/
    - Full Disclosure: http://seclists.org/fulldisclosure/2011/Apr/550
    - SecuObs.com: http://secuobs.com/revue/news/301798.shtml
    - Emerging-sigs@emerging-threats.com: http://permalink.gmane.org/gmane.com...ing-sigs/10718
    - Voice of Grey Hat: http://www.voiceofgreyhat.com/2011/0...framework.html
    - Vulnerability Database: http://www.vulnerabilitydatabase.com...work-released/
    - Information Security Guys: http://www.secguys.com/?p=67
    - National Security Alert Italia: http://www.nsai.it/tag/pytbull-ids/
    - Astalavista: http://www.astalavista.com/files/fil...-framework-03/
    - rootsec Blobgspot: http://r00tsec.blogspot.com/2011/04/...ework-for.html
    - packet storm: http://packetstormsecurity.org/files...tbull-1.0.html

    Feel free to contact me if you need any further information.
    Many thanks in advance for your support and your interest.

    Regards,

    Sébastien Damaye
    Website: http://www.aldeid.com
    Twitter: http://www.twitter.com/sebastiendamaye
    Youtube: http://www.youtube.com/user/sebastiendamaye

  2. #2
    Just burned his ISO
    Join Date
    May 2008
    Posts
    4

    Default Re: Pytbull in Backtrack

    This is a very useful tool. I would like to see it included as well. Thanks!

  3. #3
    Just burned his ISO
    Join Date
    May 2011
    Posts
    3

    Default Re: Pytbull in Backtrack

    I've recently loaded up and ran some tests with Pytbull in BT5 and this tool is awesome for testing your IDS/IPS systems. I've tried some other IDS testing tools in the past and Pytbull is miles ahead and has really filled a gap in this area.

    I highly recommend everyone runs Pytbull to validate and fine tune their IDS/IPS systems. It would be great to see Pytbull included in future versions of BT.

    It's easy enough to get going in BT5 now, see my posts at Aldeid site on what is required to get things running on BT5 and thanks to Sébastien for fixing some small bugs.

    Keith

  4. #4
    Just burned his ISO
    Join Date
    May 2011
    Posts
    1

    Thumbs up Re: Pytbull in Backtrack

    Pytbull is an awesome tool. A must for Back|Track !!!
    Very useful for detecting Attacks. A great turnkey solution for validating IPS/IDS systems.

    We at VulnerabilityDatabase.com are really appreciate this kind of "Gem" !!

    Hope it will be included into BT5, it will really ease our lives..

    Nabil
    Maintainer of VulnerabilityDatabase.com

  5. #5
    Just burned his ISO
    Join Date
    May 2011
    Posts
    1

    Default Re: Pytbull in Backtrack

    I believe this tool should be included with the Backtrack distribution.

  6. #6
    Just burned his ISO
    Join Date
    May 2011
    Posts
    2

    Default Re : Re: Pytbull in Backtrack

    Hi guys,
    Thanks to your support, pytbull is now included in BackTrack.
    To see it, just issue apt-get update && apt-get install pytbull.
    It appears in:
    - CLI: /pentest/enumeration/ids/pytbull/
    - GUI: Applications > BackTrack > Information Gathering > Network Analysis > IDS IPS Identification > pytbull
    Many thanks again to all of you guys!!!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •