topic Re: Cloning traffic to simulate attacks/vulnerabilities in General Topics

Cloning traffic to simulate attacks/vulnerabilities

ikinnexi — Tue, 05 Apr 2011 21:40:14 GMT

Hi,

Has anyone ever tried to clone malicious traffic sent through the palo-alto firewall to try to re-simulate attacks or exploit vulnerabilities?

If you have, can you share your experience in how you did it?

Just trying to research on some ideas of how to seek exploit possibile vulnerabilities based on traffic that I might think is malicious.

If you need some more info, let me know.

Thanks.

Re: Cloning traffic to simulate attacks/vulnerabilities

cl.tech — Tue, 05 Apr 2011 21:44:58 GMT

This is something to look at.

http://tomahawk.sourceforge.net/

Keith

Re: Cloning traffic to simulate attacks/vulnerabilities

ikinnexi — Tue, 05 Apr 2011 22:12:57 GMT

Is it possible to use the PA-2xxx series to span/mirror traffic from one port to another?

Either in PanOS 3.1 or 4.0?

It would be very handy since we have so many unused ports on the device, and don't have any taps lying around.

Any info you can provide on this would be great.

Thank You.

Re: Cloning traffic to simulate attacks/vulnerabilities

rmonvon — Wed, 06 Apr 2011 00:49:01 GMT

We currently do not support spanning/mirroring traffic from the PAN device today. Please contact your local Palo Alto SE to submit this feature as a feature request. In the meantime, you can use our packet capture feature to help during troubleshooting.

Thank you very much for your spanning suggestion!!

Re: Cloning traffic to simulate attacks/vulnerabilities

kbrazil — Wed, 06 Apr 2011 01:21:32 GMT

Actually, Virtual Wire acts a bit like an inline tap. Any packets that are seen on the interface are forwarded out the second interface in the Virtual Wire. If you are out of SPAN ports you can put the PAN device in between an existing SPAN port and another device using the SPAN with a couple interfaces in Virtual Wire mode and allowing all traffic to pass via open security policy.

Cheers,

Kelly

Re: Cloning traffic to simulate attacks/vulnerabilities

bhlee — Wed, 06 Apr 2011 03:09:27 GMT

I usually use "Colasoft Packet Player".

if you have exploit packet capture like exploit.pcap, then , use that tool. you can 'replay' that packet capture by sending it to the PA in TAP mode interface.

then PA will detect the attack.

thank you

BH Lee

Re: Cloning traffic to simulate attacks/vulnerabilities

migration — Mon, 11 Apr 2011 19:02:47 GMT

You can always get a packet capture of the specific traffic you want and replay it through a device with TCPreplay or Scapy.