3coresec/testmynids.org

A website and framework for testing NIDS detection

testmynids.org

A website and framework for testing NIDS detection

What is it?

A simple project that aims to centralize testing for detection of malicious events by network intrusion detection systems (NIDS). The tests in this project are built against rulesets, not software. Therefor, if you're using ET Open, coverage for these tests will work.

There are two parts to it:

• A website - that is used to hold some tests/files. It will also hold sub-domains and DNS records for when testing via DNS is required.
• A script - That runs/simulates interaction with the website or with 3rd party websites, meant to be executed on the client for which you want to test coverage of your NIDS sensor.

Usage

Only requirements are curl and nc, which should be included in your distribution.

One-liner to download and execute in interactive mode:

curl -sSL https://raw.githubusercontent.com/3CORESec/testmynids.org/master/tmNIDS -o /tmp/tmNIDS && chmod +x /tmp/tmNIDS && /tmp/tmNIDS

One-liner to download and execute in script mode:

curl -sSL https://raw.githubusercontent.com/3CORESec/testmynids.org/master/tmNIDS -o /tmp/tmNIDS && chmod +x /tmp/tmNIDS && /tmp/tmNIDS -h

Tip: Replace the -h with -N (where N is the test you want - see table below) at the end of the one-liner to automatically run the desired test

Interactive mode

To run tmNIDS in interactive mode without using the one-liner, download and run the script.

After downloading tmNIDS make it executable (chmod +x tmNIDS) and run it (./tmNIDS) to be presented with the wizard:

Script mode

To run tmNIDS in script mode without using the one-liner, download and run the script.

After downloading tmNIDS make it executable (chmod +x tmNIDS) and run it (./tmNIDS -h) to be presented with the script options.

In summary, the usage of ./tmNIDS -N, where N is the number of the test, will run the designated test for you.

Included tests

Test ID	Name	Protocols used
1	Linux UID	HTTP
2	Basic Authentication over clear text	HTTP
3	Several known malware-related user agents	HTTP
4	Known bad CA's & Certificates	TLS, DNS & TCP
5	Tor .onion response and random Tor nodes connection	DNS & TLS
6	EXE download over HTTP (from AWS S3) & Packed Executable	HTTP
7	PDF download over HTTP with Embedded File	HTTP
8	Simulate an outbound SSH scan	SSH
9	Miscellaneous (TLD's, Sinkhole, DDNS, etc) domains	DNS
10	Anonymous file sharing website	DNS & TLS
11	External IP Address Lookup website	HTTP, DNS & TLS
12	URL Shortener	DNS
13	Policy Violation - Gaming	HTTP
14	Adware PUP	HTTP
15	Malware Command & Control Beacon	HTTP
99	CHAOS! Run all tests!	☝️ ALL

Why? What about insert_project_here?

Why - We can check if a NIDS engine is working with a simple rule. In most cases, a ping would do. From that moment on it becomes a matter of rulesets if detection is working or not. The purpose of this project is to quickly verify and showcase detection of as many protocols as possible, while keeping the whole process quick, portable and simple.

Other projects - I'm aware that other websites, projects and scripts exist. I created this one because the existing ones were

• lacking features
• no longer supported
• not portable enough
• too many dependencies

Choose whatever works best for you.

Feedback

Found this interesting? Have a question/comment/request? Let us know!

Feel free to open an issue or ping us on Twitter.

testmynids.org's Issues

Suricata not alerting on file download via HTTP

I am using the ET Open ruleset but when i test the 6) or 7) Suricata does not give me an alert. But i can see the traffic on the events log. What am i doing wrong?

Also not alerting on 1) and 2) aswell

Bad Certificate Authorities (test 4) no longer triggering Suricata

Hello.

I use your tool faithfully to test my NIDS system (Suricata on OPNsense) and within the last couple of months, I have noticed that test 4, Bad Certificate Authorities, no longer seems to trigger a Suricata alert.

If I'm understanding the fields in the rule set(s) (https://rules.emergingthreats.net/open/suricata-7.0.3/emerging-all.rules) correctly, could it be because the rules for both certificates (edellroot and superfish) contain "deprecation_reason Age"?

Does this mean the rules aren't actually triggering anymore?

Is there a different certificate that could be used for the test now?

Unreachable IPs in MD5 in TLS Certificate Signature (Test 10)

Hi,

First of all, thank you very much for this tool 😄.

Secondly, when I launch MD5 in TLS Certificate Signature (Test 10), it stucks. I have taken a quick look at your script (tmNIDS) in order to find out what this test does.

test_md5rsa () {
  # This test is made possible by Barracuda, as they still believe MD5 in certificates is OK
  for ip in 64.235.158.{25..30}
    do
      echo Q | openssl s_client -connect ${ip}:443 -tls1 > /dev/null 2>&1
    done
}

I have used several commands, for example: nc or ping and it seems to be that these IPs range are not reachable.

Thanks in advance,

Regards