Cloning traffic to simulate attacks/vulnerabilities

Reply
Highlighted
Not applicable

Cloning traffic to simulate attacks/vulnerabilities

Hi,

Has anyone ever tried to clone malicious traffic sent through the palo-alto firewall to try to re-simulate attacks or exploit vulnerabilities?

If you have, can you share your experience in how you did it?

Just trying to research on some ideas of how to seek exploit possibile vulnerabilities based on traffic that I might think is malicious.

If you need some more info, let me know.

Thanks.

BA

Tags (1)
L0 Member

Re: Cloning traffic to simulate attacks/vulnerabilities

This is something to look at.

http://tomahawk.sourceforge.net/

Keith

Not applicable

Re: Cloning traffic to simulate attacks/vulnerabilities

Is it possible to use the PA-2xxx series to span/mirror traffic from one port to another? 

Either in PanOS 3.1 or 4.0?
   
It would be very handy since we have so many unused ports on the device, and don't have any taps lying around.

Any info you can provide on this would be great.

Thank You.

BA 
   

L6 Presenter

Re: Cloning traffic to simulate attacks/vulnerabilities

We currently do not support spanning/mirroring traffic from the PAN device today.  Please contact your local Palo Alto SE to submit this feature as a feature request.  In the meantime, you can use our packet capture feature to help during troubleshooting.

Thank you very much for your spanning suggestion!!

L4 Transporter

Re: Cloning traffic to simulate attacks/vulnerabilities

Actually, Virtual Wire acts a bit like an inline tap.  Any packets that are seen on the interface are forwarded out the second interface in the Virtual Wire.  If you are out of SPAN ports you can put the PAN device in between an existing SPAN port and another device using the SPAN with a couple interfaces in Virtual Wire mode and allowing all traffic to pass via open security policy.

Cheers,

Kelly

Not applicable

Re: Cloning traffic to simulate attacks/vulnerabilities

I usually use "Colasoft Packet Player".

if you have exploit packet capture like exploit.pcap, then , use that tool. you can 'replay' that packet capture by sending it to the PA in TAP mode interface.

then PA will detect the attack.

thank you

BH Lee

L0 Member

Re: Cloning traffic to simulate attacks/vulnerabilities

You can always get a packet capture of the specific traffic you want and replay it through a device with TCPreplay or Scapy.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!