Autopwn against snort problems

[JamesN]

1. I have a VM of Linux based Snort running in my lab.
2. On one workstation I am using the BT2 CD.
3. Then I have the host XP box running the VM of snort.

I can "db_nmap xxx.xxx.xxx.xx1" which is the XP host for the VM no problem.

I can not get "db_nmap xxx.xxx.xxx.xx2" which is the snort VM to work. It just sits there. And because of this when I run the "db_autopwn -p -t -e" it will not target the xxx.xxx.xxx.xx2 snort VM. NOTE - This works and retargets the XP host with no problems.

If I run a "nmap -v -A -T4 xxx.xxx.xxx.xx2" against snort, I get the OS, the ports, etc. AND snort registers the alerts.



What step am I missing here to make autopwn target a Snort VM machine?


My thoughts... since snort usually puts the nic in stealth mode, db_nmap is having issues targeting it, but that doesn't explain the nmap -A stuff from above.

[streaker69]

1. I have a VM of Linux based Snort running in my lab.
2. On one workstation I am using the BT2 CD.
3. Then I have the host XP box running the VM of snort.

I can "db_nmap xxx.xxx.xxx.xx1" which is the XP host for the VM no problem.

I can not get "db_nmap xxx.xxx.xxx.xx2" which is the snort VM to work. It just sits there. And because of this when I run the "db_autopwn -p -t -e" it will not target the xxx.xxx.xxx.xx2 snort VM. NOTE - This works and retargets the XP host with no problems.

If I run a "nmap -v -A -T4 xxx.xxx.xxx.xx2" against snort, I get the OS, the ports, etc. AND snort registers the alerts.



What step am I missing here to make autopwn target a Snort VM machine?


My thoughts... since snort usually puts the nic in stealth mode, db_nmap is having issues targeting it, but that doesn't explain the nmap -A stuff from above.

A proper Snort installation should nod have an IP address assigned to the sensor NIC.

[JamesN]

Thankyou for the quick reply. The snort install is another issue. Why can't I target autopwn to that IP address?

On a side note, is there a snort hardening white paper floating around here?

[The_Denv]

Thankyou for the quick reply. The snort install is another issue. Why can't I target autopwn to that IP address?

On a side note, is there a snort hardening white paper floating around here?

As streaker said, if you installed Snort properly it should not have an IP address. If it had an IP address it would be detected to outsiders. Your Snort box is not meant to be seen; i.e: no IP address...you do have it connected to your switch and passive tap/hub right?

Snort papers, try this Google search :

Google Search

EDIT: If you look in the General IT thread you should find a thread discussing Snort....search

[JamesN]

again, snort lab setup aside...

why can I nmap the ip address nmap -v -A xxxx, but when I do a db_nmap xxxxxx I get nothing?

[thorin]

Seems like a problem with your database setup.

[JamesN]

Thanks. I redid it all from scratch again for the Nth time and it worked. Not sure why it would not work before. Now to harden that test snort box.