flightsim – 恶意网络流量生成与评估标记

发表于 2019年05月25日
安全工具

目录表

flightsim流量模拟器

Flightsim 是一个轻量级实用程序，用于生成恶意网络流量，并帮助安全团队评估安全控制和网络可见性。该工具执行测试来模拟 DNS 隧道、 DGA 流量、对已知活动 C2目的地的请求以及其他可疑流量模式。也可称为恶意网络流量模拟器。

flightsim安装

从 Releases 页面下载最新的 flightsim 二进制文件。该工具可以在任何环境(例如 Linux、 MacOS、 Windows)下使用 Golang 构建，如下所示:

go get -u github.com/alphasoc/flightsim/...

1	go get -u github.com/alphasoc/flightsim/...

运行flightsim流量模拟器

$ flightsim --help

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)

flightsim is an application which generates malicious network traffic for security
teams to evaluate security controls (e.g. firewalls) and ensure that monitoring tools
are able to detect malicious traffic.

Usage:
  flightsim [command]

Available Commands:
  help        Help about any command
  run         Run all simulators (default) or a particular test
  version     Print version and exit

Flags:
  -h, --help   help for flightsim

Use "flightsim [command] --help" for more information about a command

$ flightsim --help

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)

flightsim is an application which generates malicious network traffic for security

teams to evaluate security controls (e.g. firewalls) and ensure that monitoring tools

are able to detect malicious traffic.

Usage:

flightsim [command]

Available Commands:

help Help about any command

run Run all simulators (default) or a particular test

version Print version and exit

Flags:

-h, --help help for flightsim

Use "flightsim [command] --help" for more information about a command

运行单个模块来生成恶意流量。要执行所有可用的测试，使用flightsim run，注意: 当运行 C2模块时，flightsim 将从网络犯罪跟踪器（Cybercrime Tracker）和 AlphaSOC API 中收集当前的 C2地址，因此需要外部互联网访问。

列出可用的模块flightsim run --help。要执行特定的测试，使用 flightsim run <module>，如下所示：

$ flightsim run --help
Run all simulators (default) or a particular test

Usage:
  flightsim run [c2-dns|c2-ip|dga|hijack|scan|sink|spambot|tunnel] [flags]

Flags:
  -n,                      number of hosts generated for each simulator (default 10)
      --fast               run simulator fast without sleep intervals
  -h, --help               help for run
  -i, --interface string   network interface to use

$ flightsim run dga

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)
The IP address of the network interface is 172.31.84.103
The current time is 10-Jan-18 09:30:28

Time      Module   Description
--------------------------------------------------------------------------------
09:30:28  dga      Starting
09:30:28  dga      Generating list of DGA domains
09:30:30  dga      Resolving rdumomx.xyz
09:30:31  dga      Resolving rdumomx.biz
09:30:31  dga      Resolving rdumomx.top
09:30:32  dga      Resolving qtovmrn.xyz
09:30:32  dga      Resolving qtovmrn.biz
09:30:33  dga      Resolving qtovmrn.top
09:30:33  dga      Resolving pbuzkkk.xyz
09:30:34  dga      Resolving pbuzkkk.biz
09:30:34  dga      Resolving pbuzkkk.top
09:30:35  dga      Resolving wfoheoz.xyz
09:30:35  dga      Resolving wfoheoz.biz
09:30:36  dga      Resolving wfoheoz.top
09:30:36  dga      Resolving lhecftf.xyz
09:30:37  dga      Resolving lhecftf.biz
09:30:37  dga      Resolving lhecftf.top
09:30:38  dga      Finished

All done! Check your SIEM for alerts using the timestamps and details above.

$ flightsim run --help

Run all simulators (default) or a particular test

Usage:

Flags:

-n, number of hosts generated for each simulator (default 10)

--fast run simulator fast without sleep intervals

-h, --help help for run

-i, --interface string network interface to use

$ flightsim run dga

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)

The IP address of the network interface is 172.31.84.103

The current time is 10-Jan-18 09:30:28

Time Module Description

--------------------------------------------------------------------------------

09:30:28 dga Starting

09:30:28 dga Generating list of DGA domains

09:30:30 dga Resolving rdumomx.xyz

09:30:31 dga Resolving rdumomx.biz

09:30:31 dga Resolving rdumomx.top

09:30:32 dga Resolving qtovmrn.xyz

09:30:32 dga Resolving qtovmrn.biz

09:30:33 dga Resolving qtovmrn.top

09:30:33 dga Resolving pbuzkkk.xyz

09:30:34 dga Resolving pbuzkkk.biz

09:30:34 dga Resolving pbuzkkk.top

09:30:35 dga Resolving wfoheoz.xyz

09:30:35 dga Resolving wfoheoz.biz

09:30:36 dga Resolving wfoheoz.top

09:30:36 dga Resolving lhecftf.xyz

09:30:37 dga Resolving lhecftf.biz

09:30:37 dga Resolving lhecftf.top

09:30:38 dga Finished

All done! Check your SIEM for alerts using the timestamps and details above.

flightsim模块介绍

下面是该工具自带的模块包

模块名	模块描述
c2-dns	生成当前的C2目的地址列表，分别执行DNS请求
c2-ip	随机连接10个当前列表中的C2 IP地址:端口，模拟攻击会话
dga	使用随机标签和顶级域名模拟DGA流量
hijack	通过ns1.sandbox.alphasoc.xyz测试DNS劫持
scan	使用常见端口对10个随机RFC 1918地址进行端口扫描
sink	对10个安全提供商的随机地址进行安全测试
spambot	随机解析并连接互联网SMTP服务器，测试欺诈端口
tunnel	生成DNS隧道请求并发送至*.sandbox.alphasoc.xyz