Nessus, Snort, and Ethereal Power Tools: Customizing Open Source Security Applications

Front Cover
Elsevier, Sep 14, 2005 - Computers - 400 pages
Nessus, Snort, and Ethereal Power Tools covers customizing Snort to perform intrusion detection and prevention; Nessus to analyze the network layer for vulnerabilities; and Ethereal to sniff their network for malicious or unusual traffic. The book contains an appendix detailing the best of the rest open source security tools. Each of these tools is intentionally designed to be highly customizable so that users can torque the programs to suit their particular needs. Users can code their own custom rules, plug-ins, and filters that are tailor-made to fit their own networks and the threats which they most commonly face. The book describes the most important concepts of coding and customizing tools, and then provides readers with invaluable working scripts that can either be used as is or further refined by using knowledge gained from the book.
  • Snort, Nessus, and Ethereal are the three most popular open source security tools in the world
  • Only book that teaches readers how to customize these tools for their specific needs by coding rules, plugins, and filters
  • Companion Web site provides all working code and scripts from the book for download
 

What people are saying - Write a review

We haven't found any reviews in the usual places.

Contents

Debugging NASLs
15
Extensions and Custom Tests
29
Understanding the Extended Capabilities of the Nessus Environment
43
Analyzing GetFileVersion and MySQL Passwordless Test
57
Automating the Creation of NASLs
95
The Inner Workings of Snort
151
Snort Rules
181
Plugins and Preprocessors
221
Modifying Snort
255
Capture File Formats
279
Protocol Dissectors
323
Reporting from Ethereal
357
Host Integrity Monitoring Using Osiris and Samhain
401
Index
433
Related Titles
446
Copyright

Common terms and phrases

Popular passages

Page xi - ... He also promotes an inclusive, positive security philosophy for companies, which encourages communicating the merits and reasons for security policies, rather than educating only on what the policies forbid. Josh is an expert in open-source security applications such as Snort, Ethereal, and Nessus. His research interests include improving the security and resilience of the Domain Name System (DNS) and the Network Time Protocol (NTP). He also enjoys reading about the mathematics and history of...

About the author (2005)

Noam Rathaus is the co-founder and CTO of Beyond Security, a company specializing in the development of enterprise-wide security assessment technologies, vulnerability assessment-based SOCs (security operation centers) and related products. He holds an electrical engineering degree from Ben Gurion University, and has been checking the security of computer systems from the age of 13. Noam is also the editor-in-chief of SecuriTeam.com, one of the largest vulnerability databases and security portals on the Internet. He has contributed to several security-related open-source projects including an active role in the Nessus security scanner project. He has written over 150 security tests to the open source tool's vulnerability database, and also developed the first Nessus client for the Windows operating system. Noam is apparently on the hit list of several software giants after being responsible for uncovering security holes in products by vendors such as Microsoft, Macromedia, Trend Micro, and Palm. This keeps him on the run using his Nacra Catamaran, capable of speeds exceeding 14 knots for a quick getaway.

Bibliographic information