Flightsim：看我如何生成并分析恶意网络流量

go get -u github.com/alphasoc/flightsim/...

工具运行

$flightsim --helpAlphaSOCNetwork Flight Simulator™ (https://github.com/alphasoc/flightsim)flightsimis an application which generates malicious network traffic for securityteamsto evaluate security controls (e.g. firewalls) and ensure that monitoring toolsareable to detect malicious traffic.Usage:  flightsim [command]AvailableCommands:  help       Help about any command  run        Run all simulators (default) or a particular test  version    Print version and exitFlags:  -h, --help  help for flightsimUse"flightsim [command] --help" for more information about a command

该工具会运行单独模块来生成恶意流量，如果你需要执行完整测试，可以直接使用下列命令：

flightsim run

该命令会使用第一个可用的网络接口来生成恶意流量。在运行C2模块时，flightsim会从CybercrimeTracker和AlphaSOC API来收集当前的C2地址。

flightsim run --help

使用下列命令可执行特定测试：

flightsim run <module>

运行结果：

$flightsim run --helpRunall simulators (default) or a particular testUsage:  flightsim run[c2-dns|c2-ip|dga|hijack|scan|sink|spambot|tunnel] [flags]Flags:  -n,                      number of hosts generatedfor each simulator (default 10)      --fast               run simulator fast without sleepintervals  -h, --help               help for run  -i, --interface string   network interface to use$flightsim run dgaAlphaSOCNetwork Flight Simulator™ (https://github.com/alphasoc/flightsim)TheIP address of the network interface is 172.31.84.103Thecurrent time is 10-Jan-18 09:30:28Time      Module  Description--------------------------------------------------------------------------------09:30:28  dga     Starting09:30:28  dga     Generating list of DGA domains09:30:30  dga     Resolving rdumomx.xyz09:30:31  dga     Resolving rdumomx.biz09:30:31  dga      Resolving rdumomx.top09:30:32  dga     Resolving qtovmrn.xyz09:30:32  dga     Resolving qtovmrn.biz09:30:33  dga     Resolving qtovmrn.top09:30:33  dga     Resolving pbuzkkk.xyz09:30:34  dga     Resolving pbuzkkk.biz09:30:34  dga     Resolving pbuzkkk.top09:30:35  dga     Resolving wfoheoz.xyz09:30:35  dga     Resolving wfoheoz.biz09:30:36  dga     Resolving wfoheoz.top09:30:36  dga     Resolving lhecftf.xyz09:30:37  dga     Resolving lhecftf.biz09:30:37  dga     Resolving lhecftf.top09:30:38  dga     FinishedAlldone! Check your SIEM for alerts using the timestamps and details above.

工具模块介绍