Skip to content

UT Austin CS378 Ethical Hacking Group Project

Notifications You must be signed in to change notification settings

robmonte/protecc

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

protecc

CS378 Ethical Hacking Project

Maurya Avirneni, Eric Lee, Alex Ng, Robert Monetfusco

Synopsis

Protecc is a threat detection tool that monitors incoming packets to a host and counters suspicious behavior. Specifically, protecc can detect nmap scans and dictionary attacks from both public IPs and (potentially) infected local machines. Once a threat is detected, protecc extracts various details from the attacker, including IP address, MAC address, OS information, etc., and then sends a detailed alert to the system admin. It can then send deauth packets to the attacking host via MAC address on the local network and the host will be disconnected from the network. Each part of the project has the ability to run independently from the main tool functionality, so more features can be easily implemented or removed depending on the specific user’s needs.

Outline

  1. Detect suspicious behavior
    • Use packet analysis tool to monitor for nmap scans and dictionary attacks
    • Save attacker IP address
  2. Information retrieval
    • Run nmap on attacker's IP and save the results
    • If public IP, run geoip-lookup to find location and ISP information
  3. Counter
    • Retrieve router mac address
    • Send deauth packets to attacker
    • Gather information on the resulting probe requests (harvest SSIDs)

Prerequisites

About

UT Austin CS378 Ethical Hacking Group Project

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages