A normal internet connection gets attacked, a lot. The majority of attacks are of the form “hello, anybody there?” – where most people just don’t answer. But sometimes, just sometimes, the question gets an answer. Depending on the answer, the attacker will start to explore. A few weeks back I was a little bored and started fiddling. I wanted to play with my Cisco, but also wanted to play with OSSEC, but also has a GIS craving. In the end I decided to create a map of the people who ask, “hello”.

I rank OSSEC as one of my favorite pieces of open source software, and finally decided to play around with it more in my own free time. (Yup, I do this sort of stuff for fun). My goal was quite simple: send syslog packets from my Cisco to my “proxy” server, running OSSEC. I found that, although OSSEC supports Cisco IOS logging, it didn’t really work. In fact, I couldn’t find any examples or articles of anybody actually getting it to work.

I love my Snort, I really do. But sometimes, I just don’t need all the extra overhead – sometimes the resources on a server are somewhat, limited. Looking for a solution I stumbled upon PSAD , a way to detect port scans. Since port scans are often one of the first tactics used to find vulnerabilities on a server, it is a pretty good idea to detect them. Depending on the attack, I receive a nice little email telling me what is going on. To test it out I first fired up nmap, and received a few emails. Next I fired up nessus with updated plugins – you can be the judge. I now have 50 emails from myself telling me somebody is doing something naughty:

Yea, you read that right. Three commands and you can run a pen-test on your website/webserver. So, how? kelvin@home:~$ sudo apt-get install nikto kelvin@home:~$ sudo nikto -update kelvin@home:~$ nikto -h www.thoughtdeposit.net As you can see, Nikto is a web server scanner, apparently for over 3200 dangerous files/vulnerabilities. Additional features can be seen at the Nikto website, yet you will certainly want to add this old gem to your webserver toolbelt as soon as possible.