README for sneeze.pl v 1.0 - a Snort false-positive generator written in perl
Copyright (C) 2001 
Don Bailey <baileydl@mitre.org> and Brian Caswell <bmc@mitre.org>

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
 
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
 
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA


Introduction
------------

Sneeze is a Snort false-positive generator written in perl.  It will read
normal Snort rules files, parse them, and generate packets that will hope-
fully trigger those same rules.  Sneeze can be configured to use specific
network devices, source ports, spoofed IPs, as well as loop a specified
amount of times or forever.  Sneeze provides a way to safely test an IDS in
a controlled manner and provides useful output to track what you are sending
as triggers.  Sneeze has been tested with Snort 1.8 and its rules.

Further below are instructions for installing Sneeze if you're tired of
reading already.


History & How It Works
----------------------

Sneeze was thrown together one afternoon when I couldn't find a decent,
controllable, Snort alert generator to test Snortbot with.  Writing this
gave me an excuse to find out about this module Net::RawIP, which kicks
butt, and play with Perl some more, which I stink at.  Cazz made this code
pretty and even functional in some places--I got him to stop adding features
just long enough so we could tar this up and ship it out.

Sneeze does a decent job of testing a pattern-matching IDS--Snort in this case.
Sneeze takes the content portion of a snort rule, converts the hex to a string
with the rest of the string, and creates a packet with proper destination and
source addresses and ports to trigger the IDS.  Sneeze also takes into account
Snort rule fields like dsize and offset, as well as multiple contents--all of
which has not been tested extensively, but seems to work.  So Sneeze is similar
to stick, but a tad less noisy, a bit more configurable, as well as easier to
control.  You may think of Sneeze as "stick-that-doesn't-suck".


Installation & Usage
--------------------

Sneeze requires the Perl module Net::RawIP.  You can obtain this module from:

http://www.cpan.org/modules/by-module/Net/

Once you have Net::RawIP installed, simply run sneeze.pl against a target ip
using a snort rules file as input.  Like this:

./sneeze.pl -d 192.168.0.1 -f exploit.rules

Sneeze understands "includes" in rules files, and will recursively use all rules
a snort rules file points to.

Sneeze can spoof source IP and port (when appropriate).  So if you knew of a
stupid firewall that let all traffic source 53 come in from www.resolve.com,
you could do something like this to get through the firewall and wakeup the
IDS analysts on the other side:

./sneeze.pl -d 192.168.0.1 -f exploit.rules -s www.resolve.com -p 53

Sneeze normally only goes through a rules file once and generates that many 
packets.  However, if you want to run through the rules file 10 times, then:

./sneeze.pl -d 192.168.0.1 -f exploit.rules -c 10

If you want to pound the target forever with false-positive traffic then:

./sneeze.pl -d 192.168.0.1 -f exploit.rules -c -1

And if you want to use a different network device other than your default nic,
you can specify the device to use like this:

./sneeze.pl -d 192.168.0.1 -f exploit.rules -i eth1

Usage hints or help is as easy as:  ./sneeze.pl -h or ./sneeze.pl with no args 

That's nice, eh?


Files
-----

README - duh.
sneeze.pl - Sneeze perl script.
LICENSE - a copy of the GNU General Public License


Credits
-------

Marty Roesch - for Snort and its source code.  Congrats on the kid, man!
Brian Caswell - Perl god, regexp king, and codemonkey.
Don Bailey - proof of concept, nasty code, and gummi bears.
MITRE - it rocks working for 'em.  All your CVE are belong to us!
Wives - putting up with coding idiots like ourselves.

