Mon, 8th Sep 2008 04:43:45
Never fear, this site is here

#IDS.py

Language: Python
Written by doug on 2008-01-29 23:24:32

#!/usr/bin/python
#####
# author: kay ~ irc.nullnetwork.net
# date: 20/10/2005 (sorta, its 02:34 at the moment)
# description: simple intrusion detection system.
# usage: IDS [port [port [port...]]]
# tip: if you want to log connections to those ports run
#      this IDS like: ./IDS.py 123 456 > IDS.log
# ---------
# having recently heard about the snort IDS vunerablity and having
# everyone talking about it and demostrating exploits. i thought to
# myself. now, an IDS is something that i should put into python.
# even though its simple, it did teach me one thing i didnt know
# about before, python threading.
#####
import socket, sys, datetime
from threading import Thread

ports = [21, 25, 81, 443, 8000, 8080, 31337, 3000] #configurable ports
outputfilename = ""; #no file


class listenThread ( Thread ):
	def __init__ ( self, port ):
		self.port = port
		Thread.__init__ ( self )
	def run ( self ):
		self.listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
		self.listener.bind((socket.gethostname(), self.port));
		self.listener.listen(5);
		print "=[listening on " + socket.gethostname() + ":" + str(self.port) + "]=";
		while 1:
			(self.clientsocket, self.address) = self.listener.accept();
			print "=[connection: " + self.address[0] + ":" + str(self.address[1]) + "]=";
			outputfile = open(outputfilename, 'a')
			outputfile.write(str(datetime.datetime.today().ctime()) +  " >>>> =[connection: " + self.address[0] + ":" + str(self.address[1]) + "]=\n");
			outputfile.close()
			self.clientsocket.close();
	
j = 0
while j < len(ports):
	listenThread(ports[j]).start()
	j = j + 1
	
i = 1
j = 0


while i < len(sys.argv):
	go = 1
	j = 0
	
	if sys.argv[i] == "-f":
		i = i + 1
		if i < len(sys.argv):
			outputfilename = sys.argv[i]
			
		else:
			print "missing arguement after -f"
	
	while j < len(ports):
		if int(sys.argv[i]) == int(ports[j]):
			go = 0
			print "port " + str(ports[j]) + " is already been configured to open"
			break
		j = j + 1
	
	if go:
		listenThread(int(sys.argv[i])).start()
	i = i + 1
Powered by Debian, Jack Daniels, Guinness, and excessive quantities of caffeine and sugar.