Hello all...

I don't know if this is a right place to ask this, but I'll give it a try...
I am doing a thesis for my graduation, on a subject of "Linux security modules". And my plan is to create 4 virtual machines with Ubuntu, or some different distribution, and set 4 different security modules on each virtual machine. AppArmor, SELinux, Smack and TOMOYO...
And I was thinking to simulate an attack on each security module to establish what are the good sides and bad sides of each module...
So my question is... Is there a safe way to simulate the attack and to get a proof of this attack and to establish and see what I did on the way...

Thank you...

You may find this article from Linux Voice (which is now part of Linux Magazine) quite helpful: https://www.linuxvoice.com/hacking-a-beginners-guide/

2 members found this post helpful.

Thank you for this info...
I didn't have the time to read all of it, but from what I have read, it is going to be very very usefull...
If you know anything else that might be helpfull, I would be grateful...

What sort of attacks are you thinking about carrying out? The only way I can think to safely simulate an attack would be attack your own infrastructure, or in this case, vm on a local network with no internet. Now in order to see what you did while carrying out the attack, and if you don't program using the pcap library or whatever, I would recommend a good network analyzer like wireshark, snort, and/or hexinject to see and log what is going on while you are attacking yourself. And I'm still not sure of what attack you are trying to carry out exactly.. Probe scan and overflow(ddos), ssh brute force, httpd attacks, etc ... Once again, unless you can write your own port scanners, or use libssh, libcurl, libpcap, or your own libraries of functions, I would recommend programs like nmap, hydra, the aircrack-ng suite, or just discovering stuff on a live boot of kali linux to carry out the attacks..

I don't mean literally a hacking attack, just something basic that I could use to prove that I tried to test each security module. I don't even have to bypass the module, just enough that it leaves me a trace or some kind of log that will tell me that someone tried to bypass the security module.

hmmmm... I'm not sure then. I can't figure out how to 'test' a security module without carrying out an 'attack' really. Good luck on your penetration & stress testing endeavors for school though

Penetration Testing ... "pen tests."

I will be interested to read your thesis in PDF form once you've completed it and gotten your sheepskin. It could be, or could become, a thorough introduction to the various kernel facilities that you (and your mentor) select. And that would be very nice to read.