

Impost 0.1rc1 README
--------------------


Description:
------------
   Impost is a network security auditing tool designed to analyze the
forensics behind compromised and/or vulnerable daemons. There's two
different kinds of operating modes used by Impost; It can either act as
a honey pot and take orders from a Perl script controlling how it
responds and communicates with connecting clients; or it can operate as
a packet sniffer and monitor incoming data to specified destination
port supplied by the command-line arguments.

   While running, Impost keeps a history of incoming buffers for every
connection it has to deal with. These histories are normally dropped
when a socket is closed or a TH_FIN|TH_ACK flagged packet is received.
However, if at anytime during a live connection a 'suspicious' buffer
is detected, Impost will use the history corresponding with the
connection to create a log file containing all of the received data
including the suspicious buffer.

   A side from creating a log file, Impost will also try to analyze the
buffer which had been thought of as suspicious. Some of the things which
Impost will look for are machine codes, nop sleds, shellcode signatures
and a lot of other junk.

   Impost is still in early stages of development so there is a lot of
work that needs to be done. Even in these early stages, Impost proves
to be an extremely powerful multi-purpose network debugging tool.
Whether you're a software developer, a security consultant, systems
administrator or hacker - you'll find Impost very useful if applied
properly to whatever it is you do.


Requirements:
-------------

  1. Perl 5.005_003 or newer

     Website: http://www.perl.com

  2. libpcap

     Website: http://www.tcpdump.org

     Impost will still compile with-out libpcap - however packet
     sniffing will not be available.


Building Impost
---------------

The simplest way to compile this package is:

  1. `cd' to the directory containing the package's source code and type
     `./configure' to configure the package for your system.  If you're
     using `csh' on an old version of System V, you might need to type
     `sh ./configure' instead to prevent `csh' from trying to execute
     `configure' itself.

     Running `configure' takes awhile.  While running, it prints some
     messages telling which features it is checking for.

  2. Type `make' to compile the package.

   Some systems require unusual options for compilation or linking that
the `configure' script does not know about.  Run `./configure --help'
for details on some of the pertinent environment variables.

   You can give `configure' initial values for configuration parameters
by setting variables in the command line or in the environment.  Here
is an example:

     ./configure CC=c89 CFLAGS=-O2 LIBS=-lposix  


Installing Impost
-----------------

The first thing you need to do is install the programs and
documentation:

  1. Type `make install' to install the programs and any data files and
     documentation.

  2. You can remove the program binaries and object files from the
     source code directory by typing `make clean'.  To also remove the
     files that `configure' created (so you can compile the package for
     a different kind of computer), type `make distclean'.  There is
     also a `make maintainer-clean' target, but that is intended mainly
     for the package's developers.  If you use it, you may have to get
     all sorts of other programs in order to regenerate files that came
     with the distribution.

   The next step is to copy the file `impost.conf', located in the
source directory, to `.impostrc' in the home directory belonging to the
user who will be using Impost.

   You will also need to copy the file `impost.shellcodes' to a safe
location. After doing so, modify the `.impostrc' file and make sure
that you put the correct pathname for `impost.shellcodes'.

   If you don't have the priveledges to install impost, that's okay.
Just copy the binary file `src/impost' to your home directory and follow
the steps in the above two paragraphs.


License Information
-------------------

This program is free software; you can redistribute it and/or modify it under 
the terms of the GNU General Public License as published by the Free Software 
Foundation; either version 2 of the License, or (at your option) any later 
version.

This program is distributed in the hope that it will be useful, but WITHOUT 
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 
FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more 
details.

You should have received a copy of the GNU General Public License along with 
this program; if not, write to the Free Software Foundation, Inc., 59 Temple 
Place - Suite 330, Boston, MA  02111-1307, USA


Questions and feedback
----------------------

If you need any help, read the man page and files in docs/

Email: ziplock <sickbeatz@hotmail.com>
IRC: #b4b0 on EFNet

Web: http://impost.sourceforge.net/
