{"id":19909281,"url":"https://github.com/spiderlabs/ackack","last_synced_at":"2025-05-03T02:31:41.993Z","repository":{"id":139217234,"uuid":"1144660","full_name":"SpiderLabs/ackack","owner":"SpiderLabs","description":"A program to monitor network traffic and detect unauthorized sessions.","archived":false,"fork":false,"pushed_at":"2010-12-06T22:13:50.000Z","size":108,"stargazers_count":42,"open_issues_count":0,"forks_count":15,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-07T10:35:51.600Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SpiderLabs.png","metadata":{"files":{"readme":"README.txt","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2010-12-06T22:09:43.000Z","updated_at":"2025-03-31T01:08:58.000Z","dependencies_parsed_at":null,"dependency_job_id":"74bc5d29-651f-48e3-bb46-ff50358c2c46","html_url":"https://github.com/SpiderLabs/ackack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fackack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fackack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fackack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fackack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SpiderLabs","download_url":"https://codeload.github.com/SpiderLabs/ackack/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252133733,"owners_count":21699588,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T21:14:51.334Z","updated_at":"2025-05-03T02:31:41.748Z","avatar_url":"https://github.com/SpiderLabs.png","language":"Perl","funding_links":[],"categories":[],"sub_categories":[],"readme":" ______     ______     __  __       .- -.-. -.- .- -.-. -.-\r\n/\\  __ \\   /\\  ___\\   /\\ \\/ /     ______     ______     __  __\r\n\\ \\  __ \\  \\ \\ \\____  \\ \\  _\"-.  /\\  __ \\   /\\  ___\\   /\\ \\/ /\r\n \\ \\_\\ \\_\\  \\ \\_____\\  \\ \\_\\ \\_\\ \\ \\  __ \\  \\ \\ \\____  \\ \\  _\"-. \r\n  \\/_/\\/_/   \\/_____/   \\/_/\\/_/  \\ \\_\\ \\_\\  \\ \\_____\\  \\ \\_\\ \\_\\\r\n                                   \\/_/\\/_/   \\/_____/   \\/_/\\/_/\r\n\r\n\r\nReleased at Black Hat USA 2009\r\n\r\nSteve Ocepek\r\nsocepek@trustwave.com\r\nhttp://www.trustwave.com/spiderlabs\r\n\r\nINTRODUCTION\r\n============\r\n\r\nStaring at netstat is great for chasing people away from my desk, but my\r\ntherapist says I need to make more friends, so I wrote this thing. It lets\r\nyou create groups of hosts and apply policy to the types of connections being\r\nmade between them.\r\n\r\nCool stuff includes:\r\no Detection of already-running sessions\r\no Policies based on session origination and session duration\r\no Group specification using subnet, range, or WHOIS queries\r\no Policy-generated Syslog alerts\r\no It calls you \"Commander\"\r\n\r\n\r\nCONFIGURATION\r\n=============\r\n\r\nThe following configuration files should reside within the same directory\r\nas ackack.\r\n\r\nconfig.yml\r\n----------\r\n\r\nThis file is used to configure Syslog, and other miscellaneous options.\r\n\r\ngroup.yml\r\n---------\r\n\r\nContains group mappings in the form:\r\n\r\nGroupName:\r\n - address 1\r\n - address 2\r\n\r\nGroupName is alphanumeric, and allows whatever characters that the YAML\r\nparser doesn't mind. Avoid using the name \"X\", which has the special meaning\r\n\"Unknown\" in the policy section. Maybe I should check for this, but I have\r\na feeling at least one person is going to feel better about themselves after\r\ndefining the unknown.\r\n\r\nAddress can be in the form of:\r\n\r\nA single IP: 192.168.1.5\r\nA subnet:    192.168.1.0/24\r\nA range:     192.168.1.5-192.168.1.10\r\nor\r\nA WHOIS network query: (204.13.200.166) \r\n\r\nThe WHOIS query will return all IP addresses used by that specific entity\r\nand include them as part of the specified group. This makes it easy to \r\ncreate groups for Instant Messaging apps and such, which tend to use large\r\nnumbers of servers. Be careful with this feature, though. If you start\r\nincluding ISPs, you never know what might show up. It's a good idea to look\r\nat the WHOIS result yourself before including an IP address here.\r\n\r\npolicy.yml\r\n----------\r\n\r\nThis is where you specify the things that interest you. Policies take the form:\r\n\r\nsource: {server: duration, server: duration ... }\r\n\r\nBoth \"source\" and \"server\" must be defined in group.yml first. The exception\r\nis \"X\", which means \"Undefined\". Think of X as a wildcard, except it only\r\nrepresents things that are not listed in group.yml. You can create any number\r\nof policies for each source by using a comma and adding another entry. It's\r\nall YAML-compliant stuff.\r\n\r\nA source is the originator of a session, where a server is the, um,\r\none serving it. For example, when you connect to a web server, your machine\r\nis the source of the session because you initiated. The web server didn't\r\ncome to you. If it did, well that might be a good thing to catch using\r\na policy.\r\n\r\nDuration allows you to specify how long a session runs before it's interesting.\r\nEven moderately sized networks create numerous connections, so duration\r\nlets us look for the more interesting longer-term ones. Think about that\r\npesky PC Remote Control software you've been trying to eradicate, and session\r\nduration starts showing potential. The same goes for IRC bots, P2P, etc.\r\n\r\nUSAGE\r\n=====\r\n\r\nackack.pl [interface]\r\n\r\nIf interface is not supplied, a prompt will appear to choose one. Ensure that\r\nyour user account has root/admin privileges necessary to sniff packets.\r\n\r\nBinary versions of the program for Win32, Mac, and Linux are available\r\nin the bin directory. Simply copy your binary to the main ackack directory\r\nand execute.\r\n\r\nEXAMPLES\r\n========\r\n\r\nHere are some examples to get you started.\r\n\r\ngroup.yml\r\n---------\r\n\r\n# Define our subnet as \"local\"\r\nlocal:\r\n  - 192.168.1.0/24\r\n\r\n# It's ok for people to use AOL IM, so lets group some of their IM servers\r\nAOL IM:\r\n  - (64.12.23.218)\r\n  - (205.188.248.151)\r\n\r\n# Our corporate web servers\r\nservers:\r\n  - 169.254.50.51-169.254.50.100\r\n\r\npolicy.yml\r\n----------\r\n\r\n# I've defined AOL, so let's alert when local connects to anything else\r\n# for over 10 minutes\r\nlocal: {X: 10}\r\n\r\n# I don't like the idea of my servers initiating sessions\r\n# It smells of sploits\r\nservers: {X: 0, local: 0}\r\n\r\n# Normal web browsing doesn't establish long-term sessions\r\n# But bind shells do\r\nX: {servers: 10}\r\n\r\nBUGS\r\n====\r\n\r\nThis version employs Port Guessing to determine Server and Source. This means\r\nthat the lower number port is assumed to be the Server. It actually works\r\nmost of the time, but P2P and some other apps (Steam) will sometimes throw\r\nthis off. If you see Server/Source flipped in some cases, just send me\r\naggro-mail and I'll scurry around faster.\r\n\r\nPort Validation is scheduled for the next release, which is a lot less\r\ncheesy.\r\n\r\nAlso, groups shouldn't overlap right now, unless you like dice games.\r\n\r\nCREDITS/THANKS\r\n==============\r\n\r\nThanks to Nick and Rob at Spiderlabs for their encouragement and for testing\r\nthis junk, and to Brian Lauer for his help with late night compiler\r\nerrors. Also big thanks to Marc Lehmann for the great EV and AnyEvent\r\npackages, and for taking time to help me with Pcap and funky Mac BPF\r\nfile descriptors.\r\n\r\nCOPYRIGHT\r\n=========\r\n\r\nackack - A tool to monitor network sessions\r\nCreated by Steve Ocepek\r\nCopyright (C) 2009-2010 Trustwave Holdings, Inc.\r\n \r\nThis program is free software: you can redistribute it and/or modify\r\nit under the terms of the GNU General Public License as published by\r\nthe Free Software Foundation, either version 3 of the License, or\r\n(at your option) any later version.\r\n\r\nThis program is distributed in the hope that it will be useful,\r\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\r\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r\nGNU General Public License for more details.\r\n \r\nYou should have received a copy of the GNU General Public License\r\nalong with this program.  If not, see \u003chttp://www.gnu.org/licenses/\u003e\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fackack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspiderlabs%2Fackack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fackack/lists"}