[
{
"path": ".gitignore",
"content": "*.pyc\n.idea\nBriarIDS.iml\nbriar.egg-info/\ndist/\nbuild/\n/untitled\n\n"
},
{
"path": "LICENSE.txt",
"content": "MIT License\n\nCopyright (c) 2017 BriarIDS Robbie C\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
},
{
"path": "README.md",
"content": "# BriarIDS\n\nCheck out the new Donors page! I huge thanks to all those who support BriarIDS: [**Donors**](https://github.com/g3tsyst3m/BriarIDS/wiki/Donors)
\n* Also be sure to check out the [**WIKI**](https://github.com/g3tsyst3m/BriarIDS/wiki) for detailed instructions, demo videos, etc. I've updated it with plenty of useful information. *\n\nThank you all for the donations received in the last year. I do truly appreciate your support!\n\nIf BriarIDS is used for educational purposes in the classroom setting (ie. Network Security courses, etc) please send me some feedback if you don't mind, letting me know how it cooperated. Thanks!\nHere's my email: g3tsyst3m@gmail.com\n\n## Introduction\n\nA simple yet effective IDS for the Raspberry PI. BriarIDS is configured to work with Raspbian and takes advantage of the PyQT GUI frontend for an all-in-one solution that monitors your home network. Bro is now integrated into the BriarIDS GUI for additional logging options. Snorby is still a work in progress concerning an automated installation. Will post progress notes on Wordpress site periodically. \n\n![](\"https://github.com/g3tsyst3m/BriarIDS/blob/master/images/Briar.PNG?raw=true\")
\n\n## Why the name BriarIDS?\n\nIt's kinda cheesy. The name comes from the protection Briars and Brambles (Raspberry bushes) give to rabbits when under attack. \n## So how's it different from other IDS solutions?\n\nIt's not really. The key difference is how it's setup. This is a home network based IDS solution using Suricata that primarily monitors WAN traffic (LAN too if you wanted). I looked all over the web for a SIMPLE home-based IDS using the PI and getting a network TAP working; I didn't have much luck. I'll reemphasize that there were Raspberry PI solutions out there, some that were quite amazing. They just weren't very agreeable with home network-based configurations. I just wanted a simple command-line solution that's cooperative in a few minutes upon installation. Snorby and SGUIL and all the other GUI frontends are always awesome secondary add-ons and those will be integrated into BriarIDS shortly. For now, I just want to provide a simple working IDS that is fairly straight forward and user friendly.\n\n## Why the Raspberry Pi?\n\nSince I wanted to provide the most cost effective and feasible solution for homeowners to protect their network, I knew a Raspberry PI would fit the bill assuming it cooperated. A PI will run you roughly $40-$60 with a decent SDcard purchased along with it. Next, as we all know, you need a tap interface or some way to get packets into your monitoring interface. While there are other somewhat reasonably priced solutions out there, I decided to take advantage of what I already had to work with at the house. That's where Tomato Router firmware comes in. The IPTables --tee functionality did the job and copied all my WAN packets over to the Raspberry Device with ease. Once things began cooperating I wanted to share this solution with everyone. I know I can't be the only one out there who desires to have an easy and affordable solution for their home network security perimeter.\n\n## What PI OS(es) does it run on (that you have personally tested)?\n\nRaspbian, DietPI\n\n## Can this be ported to other OSes?\n\nYes. You may need to adjust some of the apt packages depending on the Linux flavor you are using. I've installed it successfully on Kali Linux (Debian 4.8.15-1kali1 (2016-12-23) x86_64 GNU/Linux). Try it out in a VM running the latest Debian or Ubuntu. It should cooperate with the exception of the critical-stack agent and libssl. You will want to download the Intel x86/x64 .deb file versus the .arm deb file currently set to download in the script. As for ssl, bro-2.5 only currently supports libssl1.0-dev so make sure you have that installed if installing on Kali Linux or other new repos.\n\n## What Router(s) have you tested this with?\n\nJust the Linksys E1200v2 thus far\n\n## What Tomato firmware version are you using?\n\ntomato-E1200v2-NVRAM64K-1.28.RT-N5x-MIPSR2-132-Max.bin\n\n## I have more questions...\n\nI hoped you would. Check out the wiki and let me know what needs to be added.\n"
},
{
"path": "Vtotalcheck.py",
"content": "#!/usr/bin/env python\nimport hashlib, httplib, mimetypes, os, pprint, simplejson, sys, urlparse\n\nDEFAULT_TYPE = 'application/octet-stream'\n\nREPORT_URL = 'https://www.virustotal.com/api/get_file_report.json'\nSCAN_URL = 'https://www.virustotal.com/api/scan_file.json'\n\ncapturedkey = open('/opt/suricata/etc/suricata/Vtotalapi.key', 'r').read()\nAPI_KEY = capturedkey.rstrip()\n#print API_KEY\n\n# The following function is modified from the snippet at:\n# http://code.activestate.com/recipes/146306/\ndef encode_multipart_formdata(fields, files=()):\n \"\"\"\n fields is a dictionary of name to value for regular form fields.\n files is a sequence of (name, filename, value) elements for data to be\n uploaded as files.\n Return (content_type, body) ready for httplib.HTTP instance\n \"\"\"\n BOUNDARY = '----------ThIs_Is_tHe_bouNdaRY_$'\n CRLF = '\\r\\n'\n L = []\n for key, value in fields.items():\n L.append('--' + BOUNDARY)\n L.append('Content-Disposition: form-data; name=\"%s\"' % key)\n L.append('')\n L.append(value)\n for (key, filename, value) in files:\n L.append('--' + BOUNDARY)\n L.append('Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"' %\n (key, filename))\n content_type = mimetypes.guess_type(filename)[0] or DEFAULT_TYPE\n L.append('Content-Type: %s' % content_type)\n L.append('')\n L.append(value)\n L.append('--' + BOUNDARY + '--')\n L.append('')\n body = CRLF.join(L)\n content_type = 'multipart/form-data; boundary=%s' % BOUNDARY\n return content_type, body\n\ndef post_multipart(url, fields, files=()):\n \"\"\"\n url is the full to send the post request to.\n fields is a dictionary of name to value for regular form fields.\n files is a sequence of (name, filename, value) elements for data to be\n uploaded as files.\n Return body of http response.\n \"\"\"\n content_type, data = encode_multipart_formdata(fields, files)\n url_parts = urlparse.urlparse(url)\n if url_parts.scheme == 'http':\n h = httplib.HTTPConnection(url_parts.netloc)\n elif url_parts.scheme == 'https':\n h = httplib.HTTPSConnection(url_parts.netloc)\n else:\n raise Exception('Unsupported URL scheme')\n path = urlparse.urlunparse(('', '') + url_parts[2:])\n h.request('POST', path, data, {'content-type':content_type})\n return h.getresponse().read()\n\ndef scan_file(filename):\n files = [('file', filename, open(filename, 'rb').read())]\n json = post_multipart(SCAN_URL, {'key':API_KEY}, files)\n return simplejson.loads(json)\n\ndef get_report(filename):\n md5sum = hashlib.md5(open(filename, 'rb').read()).hexdigest()\n json = post_multipart(REPORT_URL, {'resource':md5sum, 'key':API_KEY})\n data = simplejson.loads(json)\n if data['result'] != 1:\n print 'Result not found, submitting file.'\n data = scan_file(filename)\n if data['result'] == 1:\n print 'Submit successful.'\n print 'Please wait a few minutes and try again to receive report.'\n else:\n print 'Submit failed.'\n pprint.pprint(data)\n else:\n pprint.pprint(data['report'])\n\n\nif __name__ == '__main__':\n if len(sys.argv) != 2:\n print 'Usage: %s filename' % sys.argv[0]\n sys.exit(1)\n\n filename = sys.argv[1]\n if not os.path.isfile(filename):\n print '%s is not a valid file' % filename\n sys.exit(1)\n\n get_report(filename)\n\n"
},
{
"path": "__init__.py",
"content": ""
},
{
"path": "briarids/__init__.py",
"content": ""
},
{
"path": "briarids/briar_ids.py",
"content": "\"\"\"BriarIDS main module\r\n\r\nCreates main class and makes sure it only runs on command line.\r\n\r\n\"\"\"\r\n\r\nimport os\r\nimport sys\r\n#import subprocess\r\n#needs python3-pip\r\n#also sudo apt-get install python3-pyqt5\r\ntry:\r\n from PyQt5 import QtCore, QtGui, QtWidgets\r\n from PyQt5.QtCore import QTimer\r\n from PyQt5.QtWidgets import QApplication\r\nexcept ImportError:\r\n print ('pyqt5 not installed...installing now.')\r\n os.system(\"sudo apt-get install python-pyqt5 -y\")\r\n raise ImportError(\"ok done installing try running Briar now!\")\r\n\r\nos.system(\"sudo /usr/local/bin/./checkXauth.sh\")\r\nos.system(\"sudo /usr/local/bin/./updatecheck.sh\")\r\n\r\nimport load_briar_menu\r\n\r\n\r\nclass Main(QtWidgets.QWidget):\r\n\r\n def __init__(self):\r\n\r\n super(Main, self).__init__()\r\n print (\"loading main menu...\")\r\n #output = subprocess.check_output('sudo ip r show|grep \" src \"|cut -d \" \" -f 3,12 | awk \\'{print $1}\\'', shell=True)\r\n #print output\r\n # name of gui python script\r\n self.ui = load_briar_menu.UiForm()\r\n self.ui.setup_ui(self)\r\n\r\n\r\ndef main():\r\n\r\n app = QApplication(sys.argv)\r\n app.setStyle(\"plastique\")\r\n\r\n main = Main()\r\n main.show()\r\n sys.exit(app.exec_())\r\n\r\n\r\nif __name__ == '__main__':\r\n main()\r\n\r\n\r\n"
},
{
"path": "briarids/load_briar_menu.py",
"content": "# -*- coding: utf-8 -*-\r\n\"\"\" BriarIDS menu loader: Creates a python desktop application.\r\n\r\nDesktop application allows you to install Suricata, Bro, and Critical Stack Agent \r\nvia selectable button options. \r\n\r\nFollow wiki at https://github.com/musicmancorley/BriarIDS/wiki for latest docs.\r\n\r\n\"\"\"\r\n\r\n#from PyQt4 import QtCore, QtGui\r\nfrom PyQt5 import QtCore, QtGui, QtWidgets\r\nfrom PyQt5.QtCore import QThread, QObject, pyqtSignal\r\nimport os, sys, threading, subprocess, time\r\nfrom subprocess import Popen, PIPE, CalledProcessError\r\n\r\n\r\nclass SuricataInstallerThread(QThread):\r\n\r\n install_signal = pyqtSignal(object)\r\n\r\n def __init__(self, url):\r\n QThread.__init__(self)\r\n self.url = url\r\n\r\n def run(self):\r\n p = subprocess.Popen(self.url, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)\r\n stdout = []\r\n counter=0.0\r\n while True:\r\n line = p.stdout.readline()\r\n stdout.append(line)\r\n print (line.rstrip())\r\n if \" CC \" in str(line):\r\n counter=counter+.1\r\n self.install_signal.emit('%s' % (counter))\r\n if \"Phase-1\" in str(line):\r\n counter=7\r\n self.install_signal.emit('%s' % (counter))\r\n if \"Phase-2\" in str(line):\r\n counter=20\r\n self.install_signal.emit('%s' % (counter))\r\n if \"Phase-3\" in str(line):\r\n counter=45\r\n self.install_signal.emit('%s' % (counter))\r\n if \"Phase-4\" in str(line):\r\n counter=93\r\n self.install_signal.emit('%s' % (counter))\r\n if \"Phase-5\" in str(line):\r\n counter=97\r\n self.install_signal.emit('%s' % (counter))\r\n if \"success\" in str(line):\r\n counter=100\r\n self.install_signal.emit('%s' % (counter))\r\n if line == '':\r\n break\r\n\r\nclass BroInstallerThread(QThread):\r\n\r\n broinstall_signal = pyqtSignal(object)\r\n\r\n def __init__(self, url):\r\n QThread.__init__(self)\r\n self.url = url\r\n\r\n def run(self):\r\n p = subprocess.Popen(self.url, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)\r\n stdout = []\r\n counter=0.0\r\n while True:\r\n line = p.stdout.readline()\r\n stdout.append(line)\r\n print (line.rstrip())\r\n if \"Building CXX\" in str(line):\r\n counter=counter+.1\r\n self.broinstall_signal.emit('%s' % (counter))\r\n if \"prereqs\" in str(line):\r\n counter=3\r\n self.broinstall_signal.emit('%s' % (counter))\r\n if \"Preparing\" in str(line):\r\n counter=10\r\n self.broinstall_signal.emit('%s' % (counter))\r\n if \"coffee\" in str(line):\r\n counter=30\r\n self.broinstall_signal.emit('%s' % (counter))\r\n if \"complete!\" in str(line):\r\n counter=100\r\n self.broinstall_signal.emit('%s' % (counter))\r\n if line == '':\r\n break\r\n\r\nclass UiForm:\r\n\r\n \"\"\"Primary class that creates the BriarIDS desktop application\r\n \r\n Creates the desktop application, as well as runs bash script's depending on which button is \r\n pressed.\r\n \r\n \"\"\"\r\n\r\n def setup_ui(self, Form):\r\n \"\"\"Sets up the outline of the UI.\r\n \r\n Instantiates all the classes from the pyQt4 program and then defines the size,shape, layout of\r\n all the UI elements.\r\n \r\n param Form: pyQt4 form object\r\n \"\"\"\r\n Form.setObjectName(\"Form\")\r\n Form.resize(468, 602)\r\n Form.setMinimumSize(QtCore.QSize(468, 602))\r\n Form.setMaximumSize(QtCore.QSize(468, 602))\r\n Form.setStyleSheet(\"background-color: rgb(216, 224, 255);\")\r\n self.label = QtWidgets.QLabel(Form)\r\n self.label.setGeometry(QtCore.QRect(60, 10, 351, 16))\r\n self.label.setObjectName(\"label\")\r\n self.label_2 = QtWidgets.QLabel(Form)\r\n self.label_2.setGeometry(QtCore.QRect(10, 30, 461, 311))\r\n self.label_2.setObjectName(\"label_2\")\r\n self.comboBox = QtWidgets.QComboBox(Form)\r\n self.comboBox.setGeometry(QtCore.QRect(260, 340, 111, 22))\r\n self.comboBox.setObjectName(\"comboBox\")\r\n self.comboBox.addItem(\"\")\r\n self.comboBox.addItem(\"\")\r\n self.comboBox.addItem(\"\")\r\n self.comboBox.addItem(\"\")\r\n self.comboBox.addItem(\"\")\r\n self.comboBox.addItem(\"\")\r\n self.label_3 = QtWidgets.QLabel(Form)\r\n self.label_3.setGeometry(QtCore.QRect(70, 340, 181, 16))\r\n self.label_3.setObjectName(\"label_3\")\r\n self.pushButton = QtWidgets.QPushButton(Form)\r\n self.pushButton.setGeometry(QtCore.QRect(140, 370, 191, 51))\r\n self.pushButton.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton.setObjectName(\"pushButton\")\r\n self.pushButton_2 = QtWidgets.QPushButton(Form)\r\n self.pushButton_2.setGeometry(QtCore.QRect(140, 425, 191, 31))\r\n self.pushButton_2.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton_2.setObjectName(\"pushButton_2\")\r\n \r\n self.pushButton_6 = QtWidgets.QPushButton(Form)\r\n self.pushButton_6.setGeometry(QtCore.QRect(140, 460, 90, 31))\r\n self.pushButton_6.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton_6.setObjectName(\"pushButton_6\")\r\n \r\n self.pushButton_7 = QtWidgets.QPushButton(Form)\r\n self.pushButton_7.setGeometry(QtCore.QRect(241, 460, 90, 31))\r\n self.pushButton_7.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton_7.setObjectName(\"pushButton_7\")\r\n \r\n self.progressBar = QtWidgets.QProgressBar(Form)\r\n self.progressBar.setEnabled(True)\r\n self.progressBar.hide()\r\n self.progressBar.setGeometry(QtCore.QRect(140, 580, 211, 21))\r\n self.progressBar.setProperty(\"value\", 0)\r\n self.progressBar.setTextVisible(True)\r\n self.progressBar.setObjectName(\"progressBar\")\r\n self.pushButton_3 = QtWidgets.QPushButton(Form)\r\n self.pushButton_3.setGeometry(QtCore.QRect(140, 495, 191, 51))\r\n self.pushButton_3.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton_3.setObjectName(\"pushButton_3\")\r\n self.pushButton_5 = QtWidgets.QPushButton(Form)\r\n self.pushButton_5.setGeometry(QtCore.QRect(140, 550, 191, 21))\r\n self.pushButton_5.setStyleSheet(\"font: 11pt \\\"Lucida Handwriting\\\";\")\r\n self.pushButton_5.setObjectName(\"pushButton_5\")\r\n\r\n self.label_4 = QtWidgets.QLabel(Form)\r\n self.label_4.hide()\r\n self.label_4.setGeometry(QtCore.QRect(180, 560, 111, 16))\r\n self.label_4.setObjectName(\"label_4\")\r\n\r\n self.retranslateUi(Form)\r\n QtCore.QMetaObject.connectSlotsByName(Form)\r\n \r\n\r\n def retranslateUi(self, Form):\r\n _translate = QtCore.QCoreApplication.translate\r\n Form.setWindowTitle(_translate(\"Form\", \"BriarIDS\"))\r\n self.label.setText(_translate(\"Form\", \"