Responder Help Card
Copyright (c) 2002+ Fred Cohen & Associates - ALL RIGHTS RESERVED
Face | Type | SRC and DST | Flags | Action
|
---|
eth0 | Arp | IP | [Ss]yn | Deny [arg]
|
eth1 | Icmp | IP:Port | [Aa]ck | daZzle [arg]
|
... | Tcp | IP:Port:MAC | [Ff]in | Mirror
|
lo | Udp | . | [Pp]sh | Garble [a][%]
|
* | OtherIP | D [arg] | [Uu]rg | Ignore
|
. | * | Fin | [Rr]st | Slow
|
G [a][%] | . | Rst | [Cc]ontinue | Pose [s][d][face]
|
Tickle | Z [arg] | noHost | [Vv]erbose | .
|
Itch | Garble | noNet | [Dd]etails | a.b.c.d:p:m:m:m:m:m:m
|
Poke | Random | norouTe | [Mm]ac s/D | 0-255.*.12.12-90:@p:@m
|
Stab | ; comment | . end rules | . | =.+2.-5.g:r:...
|
| | | |
|
Hashsets: | Host | Port | Mac | [HPM] name [entry ]+
|
| | | |
|
Lisp: | ( preset | [ on arrival | ! pre-test | e.g., (setq ttlpolicy :TTLwin)
|
| ? in cond | : pre-action | + post action | e.g., ?(< ttl 2)
|
Some Examples:
(format t "~%********************Welcome to Responder*****************~%")
H weird 1.2.3.4 5.6.7.8 ; murkey hash with initial values
H bad ; initialize bad hash - no values yet
P fake 21 22 23 25 80 443 ; fake ports
H fake 12.12.23.34 12.12.23.43 ; fake hosts
M fake 1:1:1:1:1:1 ; fake MAC address
!(format t "~a~%" arphash) ; show arp hash
!(format t "~a~%" hashweird) ; show murkey hash
; hashing ARPs
:(setarphash (SLOT FROM 'SA_DATA) (arpsrc) (frommac))
* A 204.7.229.* * c I ; store ARPs in ARP cache for all ARP packets and go on
:(setarphash (SLOT FROM 'SA_DATA) (src) (frommac))
* IUTO 204.7.229.* * c I ; store ARPs in ARP cache for all ARP packets and go on
; set arphash with source from other interface to eth0
+(setarphash '(101 116 104 48 0 0 0 0 0 0 0 0 0 0) (src) (frommac))
eth1 A @target * Dv F eth0 ; eth1 ARPs forwarded to eth0
(setq ttlpolicy :TTLlin) ; default Linux TTLs
(setq TTLdistance 2) ; ttl reduction - behind a router
; set window to 0 for slowing TCP sessions
:(progn (setf (b (+ 14 offset)) 0) (setf (b (+ 15 offset)) 0))
eth0 T @bad * - Z G ; dazzle TCP on eth0 garble mode with window 0
:(if (> (inchash hashweird (list (src))) 7) (sethash hashbad (list (src))) )
:(sethash hashweird (list (src)))
eth0 T * @fake:@fake - Z R ; fake hosts count weird - turn bad
* * * * - I ; this is the default last rule - Ignore all