Syn Flood Detection

Nombre: SynFloodDetection.bash
Autor: G. Plasky
Descripción: Script que permite detectar y prevenir pequeños Syn Floods en cualquier puerto

#!/bin/bash
#####################################
#                                   #
#       SYN Flood Detection         #
#          by G. Plasky             #
#   A simple script to detect and   #
#   prevent SYN floods on any port  #
#                                   #
#####################################
 
if [ $EUID -ne 0 ]; then
        echo "You must be root to execute this script"
        exit 1
fi

PATH=/bin:/usr/bin:/sbin:/usr/sbin
 
BACKLOG=2048
RETRIES=4
 
SYN=`netstat -anp| grep SYN_RECV |wc -l`
#SYN=200
 
if [[ $SYN -ge 200 ]]
then
    echo "We appear to have a SYN flood. $SYN SYN packets detected."
    echo -n "Display netstat output? "
 
    read NET
    if [[ $NET -eq "yes" || $NET -eq "y" ]]
    then
        echo `netstat -anp|grep SYN_RECV|more`
    fi
 
    echo "Take preventative countermeasures? "
 
    read PREV
    if [[ $PREV -eq "yes" || $PREV -eq "y" ]]
    then
        echo "Enabling SYN cookies protection."
        echo 1 > /proc/sys/net/ipv4/tcp_syncookies
 
        echo "Increasing the backlog queue to $BACKLOG."
        sysctl -w net.ipv4.tcp_max_syn_backlog="$BACKLOG" &> /dev/null
 
        echo "Decreasing SYNACK retransmission time to $RETRIES."
        sysctl -w net.ipv4.tcp_synack_retries="$RETRIES" &> /dev/null
    fi
 
else
    echo "There doesn't appear to be a SYN flood right now. $SYN SYN packets detected."
fi

Permisos: chmod 700 synflooddetector.bash 

Ejecución: sudo ./synflooddetector.bash 

Leer más...

Detectar Man In the Middle

Autor: flu project
Visto en: Flu Project
Descripción: Script que permite detectar ataques man in the middle y dar de baja la interface de red.
(Para mas información sobre éste tipo de ataques consultar el siguiente link )

#!/bin/bash

if [ $# -ne 1 ]
then
echo "Uso ./mitm.sh  [ dirección mac ]"
exit
fi

mac=$1
while true
do
entradaRouter=$( arp -a | grep 192.168.1.1 | cut -d' ' -f4 )
if [ $mac != $entradaRouter ]
then
echo “Atento la Mac ha cambiado”
ifconfig  [ dispositivo red, ejemplo eth0 ] down
fi
sleep 2
done

Damos permisos de ejecución: chmod +x mitm.sh 

Ejecutamos el script: ./mitm.sh [ dirección mac ] 

Ejemplo: ./mitm.sh 00:02:cf:ce:c6:1a

Leer más...

Script para Enviar IP vía Mail

Autor: @Desconocido
Descripción: Este script comprueba la dirección IP pública de un PC y la envia a una dirección de correo.
Es útil si tiene el PC con una conexión a internet sin IP fija y se quiere conectar a él remotamente.
Puede ejecutarlo directamente con: ./mailip.sh o añadir la siguiente linea en un script de inicio: nohup mailip.sh &>/dev/null & Para ejecutarlo, primero debe modificar las variables del principio del script con sus datos de correo.

#!/bin/bash

# mailip.sh

# Script designed to read your public IP address from www.whatismyip.org
# at intervals and notify any changes by sending an email for you.

# wget and sendEmail with tsl support must be installed on your system.

# Usage:  mailip.sh  (if it can be found in your session environment PATH)
# or if you want to run it on the background:  nohup mailip.sh &>/dev/null &

# Please, you must modify the next variables to suit your needs:

DELIVER=an_account@gmail.com  # An account to send the email with the ip.
RECEIVE=$DELIVER  # An account to get the email. Don't modify to send it to the same address you especified above.
SMTP_SERVER=server.address.com:port  # The smtp server's port of the emailer account. Example: smtp.gmail.com:587
MAIL_USER=account-user
MAIL_PASS=UseR.p4s5vooRd-
TLS=yes  # yes|no    Does the mail server accept/require TLS or SSL encryption?

# The script starts here.

PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin  # paranoia
READ_IP()
{
wget -q -t 4 --no-proxy --no-cache --no-cookies -o /dev/null -O /var/publicip http://www.whatismyip.org
if [ $? -ne 0 ] ; then sleep 5m ; READ_IP ; fi
}
SEND_IP()
{
sendEmail -q -f $DELIVER -t $RECEIVE -u $SUBJECT -m $MESSAGE -s $SMTP_SERVER -xu $MAIL_USER -xp $MAIL_PASS -o tls=$TLS
if [ $? -ne 0 ] ; then sleep 5m ; SEND_IP ; fi
}

if [ $DELIVER == an_account@gmail.com ]
then echo ; echo "  Warning!  You must carefully edit some variables of the script first of all." ; echo
else
  if [ ! -e /var/publicip-sent ]
  then echo 0 > /var/publicip-sent
  fi
  while true
  do READ_IP ; sleep 12s ; sync  # paranoia
    if [ `cat /var/publicip` != `cat /var/publicip-sent` ]
    then
    SUBJECT=`hostname ; echo "IP changed:" ; cat /var/publicip`
    MESSAGE=`cat /var/publicip ; echo ; date +%F\ %T`
    SEND_IP && mv /var/publicip /var/publicip-sent
    else rm /var/publicip
    fi
  sleep 60m
  done
fi

# That was all.

# Perhaps you didn't like having to type your email password directly in the script,
# a workaround could be to assign a value like MAIL_PASS=`cat ~/password.txt` , then
# write a file called ~/password.txt with only the password in it and run the script.
# Don't forget that the password plain text file should only be readable by you,
# modificate it's permissions with chmod if needed.

Leer más...

Script para levantar como servicio RED5

Autor: Sohail Riaz
Descripción: Script que permite levantar como servicio en Fedora/CentOS/RedHat el servidor de RED5. RED5 es un potentisimo servidor de contenidos en flash y en streaming desarrollado en Java y Open Source.

#!/bin/bash
# For RedHat and cousins:
# chkconfig: 2345 85 85
# description: Red5 flash streaming server
# processname: red5
# Created By: Sohail Riaz (sohaileo@gmail.com)

PROG=red5
RED5_HOME=/usr/local/red5
DAEMON=$RED5_HOME/$PROG.sh
PIDFILE=/var/run/$PROG.pid

# Source function library
. /etc/rc.d/init.d/functions

[ -r /etc/sysconfig/red5 ] && . /etc/sysconfig/red5

RETVAL=0

case "$1" in
 start)
 echo -n $"Starting $PROG: "
 cd $RED5_HOME
 $DAEMON >/dev/null 2>/dev/null &
 RETVAL=$?
 if [ $RETVAL -eq 0 ]; then
  echo $! > $PIDFILE
  touch /var/lock/subsys/$PROG
 fi
 [ $RETVAL -eq 0 ] && success $"$PROG startup" || failure $"$PROG startup"
 echo
 ;;
 stop)
 echo -n $"Shutting down $PROG: "
 killproc -p $PIDFILE
 RETVAL=$?
 echo
 [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$PROG
 ;;
 restart)
 $0 stop
 $0 start
 ;;
 status)
 status $PROG -p $PIDFILE
 RETVAL=$?
 ;;
 *)
 echo $"Usage: $0 {start|stop|restart|status}"
 RETVAL=1
esac

exit $RETVAL

Leer más...

Configuración de red de dos tarjetas en Ubuntu

Autor: @javcasta
Función: Script que configura 2 tarjetas de red.

#!/bin/bash
# Script de configuracion de red, DNSs, ruta por defecto y llamada a reglas de IpTables

# RED
# parametros de red
ipeth0=10.50.66.3;masketh0=255.255.255.0;redeth0=10.50.66.0;broadcasteth0=10.50.66.255;gweth0=10.50.66.1
ipeth1=192.168.1.1;masketh1=255.255.255.0;redeth1=192.168.1.0;broadcasteth1=192.168.1.255
echo Configurando los interfaces de red y el DNS. ...
echo "auto lo" > /etc/network/interfaces
echo "iface lo inet loopback" >> /etc/network/interfaces
echo "# eth0 interfaz conectado al router" >> /etc/network/interfaces
echo "auto eth0" >> /etc/network/interfaces
echo "iface eth0 inet static" >> /etc/network/interfaces
echo "        address $ipeth0" >> /etc/network/interfaces
echo "        netmask $masketh0" >> /etc/network/interfaces
echo "        network $redeth0" >> /etc/network/interfaces
echo "        broadcast $broadcasteth0" >> /etc/network/interfaces
echo "        gateway $gweth0" >> /etc/network/interfaces
echo "# eth1 interfaz conectado a la LAN" >> /etc/network/interfaces
echo "auto eth1" >> /etc/network/interfaces
echo "iface eth1 inet static" >> /etc/network/interfaces
echo "        address $ipeth1" >> /etc/network/interfaces
echo "        netmask $masketh1" >> /etc/network/interfaces
echo "        network $redeth1" >> /etc/network/interfaces
echo "        broadcast $broadcasteth1" >> /etc/network/interfaces
echo "# Ruta de ultimo recurso" >> /etc/network/interfaces
echo "up route add -net 0.0.0.0/0 gw $gweth0 dev eth0" >> /etc/network/interfaces
echo "# aplicamos reglas de iptables" >> /etc/network/interfaces
echo "pre-up iptables-restore < /home/usuario/scripts/iptables.reglas.javcasta.up" >> /etc/network/interfaces
echo "# ---- by javcasta - 2.011 - http://javcasta.com ---" >> /etc/network/interfaces
# DNSs
dns1=208.67.222.222
dns2=208.67.220.220
nombreservidor=$(hostname -s)
dominio=$(hostname -d)
echo "# by script - 2.011" > /etc/resolv.conf
echo "search $dominio" >> /etc/resolv.conf
echo "domain $dominio" >> /etc/resolv.conf
echo "nameserver $dns1" >> /etc/resolv.conf
echo "nameserver $dns2" >> /etc/resolv.conf
# habilitar enrutamiento
echo "1" > /proc/sys/net/ipv4/ip_forward
# reiniciamos servicio de red
#service networking restart
/etc/init.d/networking restart

Configura lo siguiente:

Los parámetros tcp/ip de las dos tarjetas (NICs)

Los DNs

La ruta por defecto o de último recurso

La llamada a un script de ipTables

Habilitar el enrutamiento

Leer más...

Monitor-Traffic

Autor: @Tonejito
http://tonejito.blogspot.com/2011/12/monitoring-my-network-traffic.html
Función: Script que monitorea el tráfico de la red excluyendo las peticiones más comunes.

 #!/bin/bash
TCPDUMP=/usr/sbin/tcpdump
IP=/sbin/ip
DEV=en1
ADDR=`$IP addr show dev $DEV | grep 'inet ' | cut -d ' ' -f 6 | cut -d '/' -f 1`

$TCPDUMP -ni $DEV "host $ADDR and port not (67 or 68 or 80 or 443 or 1863 or 5222 or 587 or 993 or 995)"

Leer más...