INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Simulating Traffic With Scapy
Published: 2024-08-30.
Last Updated: 2024-08-30 00:01:35 UTC
by Jesse La Grew (Version: 1)
It can be helpful to simulate different kinds of system activity. I had an instance where I wanted to generate logs to test a log forwarding agent. This agent was processing DNS logs. There are a variety of ways that I could have decided to simulate this activity:
Generate the raw log file using a variety of tools including Bash, PowerShell, Python, etc
Generate DNS traffic using a Bash script, Python script, etc
Since I'm always looking for another way to use Python, I decided to use a Python script to simulate the DNS traffic.
Sending Serially
To start out, I tested sending traffic to a host one request at a time, using a loop that would continue to send requests with Scapy for three minutes ...
I was able to generate abour 42,000 requests, for a rate of about 236 requests per second. Not bad, but I wanted more. What other methods could I use to generate logs using Scapy to try and get a higher volume?
Sending Multiple Requests with Count
Next, I tried using Scapy with the "count" option. For this test I used 42,000 requests as a starting point and then measured the rate ...
This was able to give me about 312 reqeusts per second, which was a nice improvement over the previous test, approximately 32% more requests.
Sending Multiple Requests with Threading
What about using threading? Could this give me more request volume if I was able to send more data with less of a delay? ...
Read the full entry:
https://isc.sans.edu/diary/Simulating+Traffic+With+Scapy/31216/
Live Patching DLLs with Python
Published: 2024-08-29.
Last Updated: 2024-08-29 07:24:07 UTC
by Xavier Mertens (Version: 1)
In my previous diary, I explained why Python became popular for attackers. One of the given reason was that, from Python scripts, it’s possible to call any Windows API and, therefore, perform low-level activities on the system. In another script, besides a classic code injection in a remote process, I found an implementation of another good old technique: live patching of a DLL.
A typical usage of live patching is the implementation of a hook on an API. They are many ways to hook an API but a common one is called inline API hooking or « trampoline » (because we « jump » from the original function to a malicious one). In a few words, how to implement this: You modify the beginning of a function in memory so that when the function is called, it first jumps to your malicious code. After your code runs, it can pass control back to the original function, so the program behaves as if the function was called normally, but with your modifications applied. A good example of API hooking is to perform data exfiltration ...
Read the full entry:
https://isc.sans.edu/diary/Live+Patching+DLLs+with+Python/31218/