Hello everyone, and welcome to Network Activity and Packet Analysis with Python.
My name is Sean Wilkins,
and this is the Detecting Brute Force Attacks with Scapy module.
I'd like to welcome you to this module where we will pick up
from where we left off in the Displaying,
Port Scanning,
and Traceroute with Scapy module and start discussing the different ways that
you can monitor for different types of brute force attack.
Understand that brute force attacks are one of the easiest to perform attacks,
and because of this, will often be seen on networks that you are responsible for.
This module will take a look at these types of attack and
how Scapy can be used to detect them.
From your perspective as a Globomantics network security engineer,
it is important that you have an understanding of the
tools and modules like Scapy to provide for customized
solutions for detecting attacks.
To do all of this, this module will have four different sections.
The first section will focus on FTP as the server type being attacked.
The reason that we chose FTP is because it communicates in clear text and it's
easier to monitor for specific commands and their responses.
The second module moves us into the demonstration environment where we
will show an example script that we have written in Python using Scapy
to watch for these potential attacks.
In the third module,
we move on from FTP and talk about how we can potentially
monitor for brute force attacks using SSH.
In this case since SSH is encrypted,
we will be unable to monitor for these specific commands,
and because of this,
we look at a different way to monitor for these potential attacks.
In the fourth module,
we move back into the demonstration environment and show an
example script to perform this monitoring and watch for
these different attack types.
So now with all this out of the way, let's get started.