Zeek is the jack of all trades for network programming. Given its flexibility, you can do a variety of things with including signature detection that is more advanced than what Suricata or Snort...

• 
  
  
  
  
  
  
  Download mqtt-bad.pcap
  
  .
  
  
  
  
  • A few points:
  
  
  • You do not need to parse all MQTT messages, just the one for detecting the exploit.
  
  
  • Use Wireshark to see how the messages look like and navigate through the byte offsets (it will help you tremendously).
  
  
  
  
  
  

Useful

Use this to get your bro script started:https://www.bro.org/sphinx-git/frameworks/logging.html

Atom has support for syntax highlighting for brogramming. Install using:

apm install language-bro

What to use for the assignment

You can utilize VirtualBox (or some other VM) to build your testing

machines. Lab computers may be more appropriate if you load demanding

machines. Useful distros include:

• SELKS:
  https://www.stamus-networks.com/open-source/#selks
  
  
  
  
  

• 
  
  
  
  
  Links to an external site.
  
  
  

SO is by far the most demanding requiring a min of 8GB if ELK stack

is utilized. With SELKS, you can get away with 3GB. SELKS contains ELK

stack as well as Suricata as the main IDS. Kali is useful for pentests

but many of these you can initiate from your host computer. If you do

not have sudo access in the host machine check this guide if you need to

build several tools from source:Installing with no sudo access

Hints

Start with a basic script (Zeek/Bro has a basic script in their documentation -

https://docs.zeek.org/en/stable/examples/scripting/

Links to an external site.

).

This will save you a lot of guess work. Then, adapt that script to what

you need. The major task for both bullet points of the assignment is to

find the right event for what you need to do (what packet you will be

parsing and how). Once you have that event you craft the programming

logic in that event as well as call other functions.

Useful commands:

NOTICE - the function that raises the alerts (yes it is in capital letters)

|string| - gives you the length of a string

bytestring_to_count
- gives you an integer based on a bytestring (i.e., hex to int)

string[5:6] - bro support string splicing, you'll need it

Reporter/.*test.*/ == string
- regular expressions can be used using comparison operators

80/tcp - ports are specified with their protocols

To test your script against a pcap file:

zeek -r test.pcap myfile.bro

What to submit

• An automated testing suite (ATHINA -AutomatedTestingHomeworkInterface forN
  Assignments)
  
  will assist in verifying that your application is compliant with the
  
  project requirements. Once you submit the location of your files, it
  
  will test the repository and submit 90% of your grade depending on the
  
  outcome of the tests. With every new commit to your repository, it will
  
  re-evaluate and submit a new grade. This is meant to give you immediate
  
  feedback and multiple opportunities to correct your code and get full
  
  points for the assignment.


• I will also test your program by reading your source code and evaluating that everything is in order.


• Your program must be developed in a gitversion control repository.Use WWU CS's GitLab (https://gitlab.cs.wwu.edu/
  Links to an external site.
  
  ).The repository must be named
  Bro
  BasedDetection. Set the visibility settings onPrivateand add my account (tsikerm) as
  Masterto your repository.


• In your repository include the following files only:
  mqtt.bro, dnsexfilitration.bro,
  dns-normal.pcap