2013-10 BsidesDC Syllabus:

0. Setup VM
1. COPY files from stick to USB
2. Install VirtualBox & VirtualBox Extensions
3. Uncompress files- 7-zip on Windows, "The Unarchiver" on Mac
4. Open the VM (replace BroTraining.vbox)
5. logon bro/bro
6. Class files, either:
7. Mount the folder
8. git clone https://github.com/LiamRandall/BsidesDC-Training.git
9. Download zip from https://github.com/LiamRandall/BsidesDC-Training/archive/master.zip
10. What is Bro?
11. Bro is a language first
12. Event-driven
13. Built-in variables like IP address and time interval are designed for network analysis
14. Built-in functions can be implemented in C++ for speed and integration with other tools
15. A Tour of the Bro logs
16. Run Bro against a PCAP (e.g. /opt/TrafficSamples/faf-traffic.pcap)
17. Go through some of the logs (e.g. cat files.log | colorize)
18. SSL/TLS
19. Exercise: bro -C -r rsasnakeoil2.cap (pcap)
20. Exercise: bro -r basic-gmail.pcap (pcap)
21. HTTP Auth
22. Exercise: bro -C -r http-auth.pcap (pcap)
23. Exercise: bro -C -r http-auth.pcap http-auth.bro (script)
24. bro-cut
25. Exercise: bro -C -r http-basic-auth-multiple-failures.pcap
26. What is the count of the distinct status_code: cat http.log | bro-cut status_code | sort | uniq -c | sort -n
27. What were the status codes by username?
28. What happened here: 1 - test Why is this line missing the status_code? (hint: conn.log)
29. Notice Framework
30. Exercise: bro -r 01_emailing_simple.bro synscan.pcap (script, pcap)
31. Exercise: bro -r 02_emailing_complex.bro synscan.pcap (script, pcap)
32. Exercise: bro -r 03_avoid_some_scanners.bro synscan.pcap (script, pcap)
33. Exercise: bro -r 04_create_a_new_notice.bro mbam_download.trace (script, pcap)
34. Walk-through 05_create_an_action.bro
35. Intel Framework
36. Exercise
37. Exercise
38. Exercise
39. Files Framework
40. File extraction demo 1. Extract files: bro -r /opt/TrafficSamples/exercise-traffic.pcap extract-all-files.bro (script) 2. Show files: nautilus extract_files/ 3. Play a video: ```totem "extract_files/"`ls -S1 extract_files | head -n 1````
41. Writing a script: (shell, solution)
42. Running the script: bro -r 01_notice_on_mimetype.bro /opt/TrafficSamples/faf-traffic.pcap
43. Walk-through 02_run_exiftool.bro
44. Signature Framework
45. Exercise: bro -r /opt/PCAPS_TRAFFIC_PATTERNS/APT/mswab_yayih/Mswab_Yayih_FD1BE09E499E8E380424B3835FC973A8_2012-03.pcap site/local.bro
46. With file extraction: bro -r /opt/PCAPS_TRAFFIC_PATTERNS/APT/mswab_yayih/Mswab_Yayih_FD1BE09E499E8E380424B3835FC973A8_2012-03.pcap site/local.bro extract-all-files.bro (script)
47. Analyze requests/responses: for i in `bro-grep info.asp http.log | bro-cut orig_fuids resp_fuids | sed -e 's/\t/\n/' | grep -v '-'`; do cat "extract_files/extract-HTTP-$i"; echo; echo "-------"; done