ComputerSecurityStudent (CSS) [Login] [Join Now]


|WINDOWS >> Windows 7 >> Current Page |Views: 16661

(Windows 7: Lesson 4)

{ Install and Test Comodo Firewall Against BackTrack }

Section 0. Background Information
  1. Comodo Firewall 
    • Comodo Internet Security was designed around the concept of layered security and provides the following layers of protection: Antivirus, Firewall, Host-based intrusion prevent (Defense+), and Remote assistance (GeekBuddy). 

  2. Lab Notes
    • In this lab we will do the following:
      1. Download Comodo Firewall
      2. Test Comodo Firewall Against BackTrack (Ping)
      3. Test Comodo Firewall Against BackTrack (nmap basic scan)
      4. Test Comodo Firewall Against BackTrack (nmap half-open TCP scan)
      5. Test Comodo Firewall Against BackTrack (nmap SCTP INIT scan)
      6. Test Comodo Firewall Against BackTrack (nmap intense scan)

  3. Prerequisites
  4. Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2012 No content replication of any kind is allowed without express written permission.

 

Section 1. Start your Windows 7 VM
  1. Edit Virtual Machine Settings
    • Instructions: 
      1. Click on Windows 7
      2. Click on Edit virtual machine

     

  2. Configure Network Adapter
    • Instructions
      1. Select Network Adapter
      2. Click the radio button "Bridged: Connected directly to the physical network."
      3. Click the Okay button

     

  3. Start Windows 7
    • Instructions: 
      1. Click on Windows 7
      2. Click on Play virtual machine

     

Section 2. Login to Windows 7
  1. Login
    • Instructions:
      1. Enter Password
      2. Click the Blue Arrow

 

Section 3. Verify you have a Network IP Address
  1. Bring up Command Prompt
    • Instructions:
      • Start --> Command Prompt

     

  2. Verify IP Address
    • Instructions:
      1. ipconfig
    • Notes:
      • In my case, my IP Address is 192.168.1.106.
      • In your case, your IP Address will probably be different.

 

Section 4. Install Spybot Search and Destroy
  1. Open Internet Explorer
    • Instructions:
      1. Click the Start Button
      2. Type "Internet Explorer" in the search box
      3. Click on Internet Explorer

     

  2. Go to the Comodo Firewall Site
    • Instructions:
      1. Paste the following website address in the URI box.
        • http://personalfirewall.comodo.com/
      2. Click the Download Button

     

  3. File Download
    • Instructions:
      1. Click Run

     

  4. Do you want to run this software?
    • Instructions:
      1. Click Run

     

  5. User Account Control
    • Instructions:
      1. Click Yes

     

  6. Select Setup Language
    • Instructions:
      1. Select the language:  English (United States) - By COMODO
      2. Click OK

     

  7. Optional Entry
    • Instructions:
      1. It is not necessary to supply your email.
      2. It is not necessary to check any of the check boxes.
      3. Just click on Agree and Install

     

  8. Installing
    • Informational:
      1. Continue to Next Step

     

  9. Select Network
    • Instructions:
      1. Select the appropriate network that matches yours.
      2. If you are at a school, coffee shop, airport, etc; then you will select "I am at PUBLIC PLACE"

     

  10. Restart Your Machine
    • Instructions:
      1. Click Fix It

     

  11. Select Start Menu Folder
    • Instructions:
      1. Select Next

 

Section 5. Configure BackTrack Virtual Machine Settings
  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player

     

  2. Edit BackTrack Virtual Machine Settings
    • Instructions:
      1. Highlight BackTrack5R1
      2. Click Edit virtual machine settings

     

  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Do not Click on the OK Button.

 

Section 6. Login to BackTrack
  1. Start BackTrack VM Instance
    • Instructions:
      1. Start Up VMWare Player
      2. Select BackTrack5R1
      3. Play virtual machine

     

  2. Login to BackTrack
    • Instructions:
      1. Login: root
      2. Password: toor or <whatever you changed it to>.

     

  3. Bring up the GNOME
    • Instructions:
      1. Type startx

 

Section 7. Open Console Terminal and Retrieve IP Address
  1. Open a console terminal
    • Instructions:
      1. Click on the console terminal

     

  2. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • As indicated below, my IP address is 192.168.1.107.
      • Please record your IP address.

 

Section 8. Test Comodo Firewall with BackTrack (Ping)
  1. Ping Windows 7
    • Notes:
      • Obtain the IP Address of the Window 7 machine running Comodo from (Section 3, Step 2)
    • Instructions:
      1. ping -c 5 192.168.1.106
        • -c, this flag indicates the number of pings, which in this example is 5 pings.
        • 192.168.1.106 is the IP Address for my Windows 7 machine.

     

  2. Open Comodo Firewall
    • Instructions:
      1. Click on the Comodo Firewall Icon

     

  3. View Firewall Events
    • Instructions:
      1. Click on View Firewall Events

     

  4. Reviewing Firewall Events
    • Note:
      1. Notice that Comodo did not alert us of the BackTrack ping.

 

Section 9. Test Comodo Firewall with BackTrack (nmap basic scan)
  1. Conduct Basic nmap scan
    • Instructions:
      1. nmap 192.168.1.106
    • Notes:
      • Obtain the IP Address of the Window 7 machine running Comodo from (Section 3, Step 2)

     

  2. Viewing Firewall Alerts
    • Notes:
      • Notice Comodo Firewall provides an Alert this time.
    • Instructions:
      1. For our testing purposes, keep clicking the allow button until the alert messages stop.
      2. Click the Refresh Button.

     

  3. Viewing Firewall Alerts
    • Notes:
      • You should start seeing events that were initiated from BackTrack's nmap.
    • Instructions:
      1. Continue to Next Section

 

Section 10. Test Comodo Firewall with BackTrack (nmap TCP half-open stealth scan)
  1. Conduct nmap TCP half-open stealth scan
    • Instructions:
      1. nmap -sS 192.168.1.106
    • Notes:
      • Obtain the IP Address of the Window 7 machine running Comodo from (Section 3, Step 2).
      • -sS, This technique is often referred to as half-open scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and then wait for a response. It is also relatively unobtrusive and stealthy since it never completes a TCP connections.

     

  2. Viewing Comodo Results
    • Instructions:
      1. Click the allow button until no more alerts are displayed.
    • Notes:
      • Notice you were still alerted when nmap uses a half-open TCP scan.

 

Section 11. Test Comodo Firewall with BackTrack (nmap SCTP INIT scan)
  1. Conduct nmap SCTP INIT scan
    • Instructions:
      1. nmap -sY 192.168.1.106
        • Replace 192.168.1.106 with the Windows 7 IP Address obtain from (Section 3, Step 2).
    • Notes:
      • This technique is often referred to as half-open scanning, because you don't open a full SCTP association. You send an INIT chunk, as if you are going to open a real association and then wait for a response.
      • SCTP is a relatively new alternative to the TCP and UDP protocols, combining most characteristics of TCP and UDP, and also adding new features like multi-homing and multi-streaming. SCTP INIT scan is the SCTP equivalent of a TCP SYN scan. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. Like SYN scan, INIT scan is relatively unobtrusive and stealthy, since it never completes SCTP associations.

     

  2. Viewing Comodo Results
    • Notes:
      • Notice Comodo did not detect the half-open SCTP INIT scan.
    • Instructions:
      1. Continue to Next Section

 

Section 12. Test Comodo Firewall with BackTrack (nmap intense scan)
  1. Conduct nmap intense scan
    • Instructions:
      1. nmap -T4 -A -v 192.168.1.106
        • Replace 192.168.1.106 with the Windows 7 IP Address obtain from (Section 3, Step 2).
    • Notes:
      • -T, is a timing template with the following settings: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion.
      • -A, to enable OS and version detection, script scanning, and traceroute.
      • -v, is verbose mode.

     

  2. Viewing Comodo Results
    • Notes:
      • Notice Comodo is now going crazy.
    • Instructions:
      1. Click Remember my answer
      2. Keep clicking on the Block button as Alerts appear.
      3. Click the Refresh button

     

  3. Analyzing Comodo Results
    • Notes:
      • Notice Comodo is now Blocking scans from 192.168.1.107 for ports 49157, 135, and 49156.
    • Instructions:
      1. Continue to Next Step.

     

  4. Analyzing nmap Results
    • Notes:
      • Notice that although you blocked the intense scan with Comodo, nmap was still able to determine the operating system and version.
    • Instructions:
      1. Continue Next Section

 

Section 13. Proof of Lab
  1. View Firewall Events
    • Instructions:
      1. If the Comodo Firewall Dashboard is not open, click on the Comodo Firewall desktop icon.
      2. Once opened, Click on View Firewall Events.

     

  2. Open a Command Prompt
    • Instructions:
      1. Click the Start Button
      2. Type cmd in the search box
      3. Click on cmd

     

  3. Proof of Lab Instructions
    • Instructions:
      1. date
      2. Press <Enter>
      3. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
      4. Do a PrtScn
      5. Paste into a word document
      6. Upload to Moodle

 


Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth