For this module,
we will be talking about the steps that are required to perform
an analysis of packets to determine if someone is attempting to
brute force attack your systems.
For this, we will be using both Python and Scapy.
In this section specifically,
we are going to be focusing on the analysis that is required
when looking at the File Transfer Protocol,
or FTP, sessions.
The reason that this protocol was chosen is because it is commonly
used and it does not use encrypted communications.
And in our next section,
we will go to the other side of the spectrum and look at how this
could be done with secure shell or SSH sessions.
So why do you think you would need this knowledge?
As a network security professional for Globomantics,
one of your duties that you will have is ensuring that the
systems you are responsible for are kept secure.
One common low knowledge attack type is using some type of brute force method.
Usually these attacks will attempt to find the credentials of
a secured system through recurring login attempts using some
type of wordless dictionary.
Often the detection of these types of attack are left to the
automated capabilities of deployed security appliances,
but in other cases, a more in‑depth hands‑on approach is required or needed.
This is really what this course generally is designed to teach what a
security professional could do with a little bit of networking and
programming knowledge and something to analyze.
For this module,
we will be designing our code based on the assumption
that a capture of the offending attacks has been saved
and is available to be analyzed.
With a little bit of tweaking, it could,
however,
also be designed to perform this analysis during a live capture of traffic.
How do you think we could analyze this FTP traffic to
determine whether multiple attacks are occurring?
One way to do this is to monitor the user and password process
that goes on between a client and a server and keep track of how
many good and bad logins are occurring.
Then with this knowledge,
we can determine whether we think something normal is
occurring or whether something nefarious is.
To do this,
we must have some basic knowledge level of FTP and how it
communicates when performing username and password logins.
As luck would have it,
FTP actually uses USER and PASS commands that relay this
information between the client and server.
This makes it reasonably simple to match the traffic that is being
used to relay these different specific commands.
The next question is,
how does the server respond to the credentials that the client is sending?
For this,
there are two different main responses that we are going to be looking for.
These include the 230 login successful message and
the 530 login incorrect message.
As you would imagine,
the former is sent from the server when the credentials that are submitted
to it are correct and then further communications can continue while the
latter is sent from the server when they don't.
What this means is that if we track each of these exchanges,
we can collect a list of the sessions that include both
successful and unsuccessful login attempts.
If this information is viewed individually,
it may be hard to reach a determination of whether it is a simple
problem with someone forgetting their credentials or if there is
something else more concerning happening.
This is why it is important to collect this information as a whole
across multiple potential sessions and then analyze it.
And so now with this reviewed,
let's move into the next section where we will move into the demonstration
environment and show how we can implement this analysis.