Re: Testing Snort

[Kiira Triea <kiira-t () mail bsasinc org>]

Hi, 

> One way to test Snort if your using it to watch a webserver is to use 
> www.safeweb.com or www.anonymizer.com and surf to you server and put cmd.exe at 
> the end of the url.  This should trigger the cmd.exe exploit rule.
> www.yourwebserver.com/cmd.exe
>
>
> >     Hello, I am new to snort and am wondering how other people test to see
> > if snort is working on their system.  I have seen security auditing
> > systems available on the web for on demand system challenges...is that
> > how you do it?  Or enlist a friend with scanning software?
> >
> > -Jonathan

Another way to generate "attacks" of your own is to get the nemesis package
from www.packetfactory.net and build frames that trigger alerts. You can put
anything in the payload as well. It's convenient (and fun!) to create
single tcp,udp or icmp frames and see how they trigger. 

Kiira 


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users