Ravindra BagaleCourses & study guides

42. Evading IDS, Firewalls and Honeypots – Detection Games

42.9 Project, Ethics and IT Act

By Last updated:

Allowed pattern (same spirit as session chapter):

  1. Build a detection stack you own
  2. From Kali, generate benign scans against that stack / Metasploitable
  3. Read what the sensor saw; stop
  4. Fix / tune rules and firewalld; re-test
  5. Snapshot / revert

Banned: scanning institute Wi-Fi "for Snort practice", silencing a client's IPS, selling "IDS bypass" PDFs, using Cowrie to attack back, fragroute against anything you do not own.

Ethics line: written permission + own lab; IT Act awareness (sections such as 43 and 66 – verify current text); CERT-In / company IR if this were production. Responsible disclosure ≠ "I bypassed your WAF on the live .in shop".

Red team (attacker) does Blue team (defender) detects / stops
Ignores scope; scans random public IPs Written lab scope; host-only; legal reminder in notes
Shares "undetectable nmap" WhatsApp kits Blue teaches: that is unauthorized access material – never
Leaves Suricata on bridged adapter facing ISP Host-only / NAT lab; snapshot hygiene

Ravindra Bagale's Tip

"Just one scan of the neighbour's router" = a career and legal risk. CEH exam modules also put authorization first. Use your own VM. Remember this.

Lab

Pair: one builds Path A/B; other only nmaps the agreed IP list. Both write 4-line IT Act reminder. Switch. No bridged LAN.

Project: Build it, hack it, fix it

Build: On YOUR host-only Blue VM (e.g. Amazon Linux / Ubuntu 192.168.56.40) for fictional Sahyadri Traders (Pune) edge: (1) firewalld or ufw with at least SSH + one dummy HTTP port, (2) Suricata or firewalld --set-log-denied=all + a rich rule that logs scans, (3) HOME_NET / zone includes 192.168.56.0/24, (4) chrony on, (5) optional: Cowrie on a separate throwaway VM .50 with no route to real data. Deliberate weak start: public zone too open, Suricata default HOME_NET still 192.168.0.0/16 or interface eth0 when host-only is eth1. Snapshot pre-weak-ids. Hack (lab only): From Kali 192.168.56.10, nmap -sS -T2 -p 21,22,80,443,3306 against 192.168.56.40 and Metasploitable 192.168.56.20. Document: did fast.log / eve.json / LAB-SCAN / denied logs show src .10? If sensor is not the destination, enable promiscuous on host-only in the hypervisor – still lab only. Never add fragment/decoy/bypass flags to "beat" the sensor, never scan past host-only. Fix: Correct HOME_NET and interface; sudo service suricata restart; tighten firewalld (SSH only from .10; drop dummy ports); add a local rule or rich rule you can explain; forward logs if you have a tiny SIEM; sudo firewall-cmd --reload. Re-verify: Same nmap now produces a clear alert/deny you can show owner Rani; SSH from Kali still works; SSH from a non-allow IP fails and logs. Purple note: Red proved the scan is traffic you can see; Blue proved rules + allow-list + time sync without touching the internet.