Assignment Task
1. Execute the attack against machine SaturnaN by exploiting the selected vulnerability using Metasploit. Capture sample attack packets using Wireshark (you can start Wireshark, just before typing the “run” or “exploit” command in Metasploit; and stop it after the attack has completed).
2. Analyze the sample attack packets, and define new Snort rules (as many as you think are necessary) to detect the attack, and add these rules to the snort rule set in SaturnaR. Justify the rationale for the rules. Make sure your Snort rules do not over-fit the attack scenario.
3. Configure Snort (on SaturnaR machine) and run it in intrusion detection mode. Re-execute the attack against SaturnaN using your attack machine (i.e. Kali), and collect the Snort alerts log generated after the attack.
4. Define new IPTables rules to mitigate the impact of the attack (against SaturnaN ). Test the rules by running once again the attack. Justify the rationale for those rules. Since you may not have root access to SaturnaN, you can test the rules by deploying them on your Kali machine (note that such configuration is valid only for testing purpose; ideally you would deploy the IPTables rules on SaturnaN and perform the test).
5. By reviewing the scan results (obtained in project – Part 1), suggest and describe any additional defense strategy required to protect the target systems.
