beSTORM Monitoring

The first option is to use GnuDB (debugger). You can instruct this open source and widely available debugger to inform beSTORM whenever an exception occurs using the gdb_monitor.pl, gdb_monitor.py, and gdb_monitor_python3.py scripts (located in the beSTORM installation folder). For more information, see How does the monitoring process for Linux work? (13.4.0 or later) on Fortra's Beyond Security Portal.

In some cases, debugging is not possible as the process spawns new child processes or is a kernel module. In these cases, you can use a non-debugger beSTORM monitor agent.

For example, one of the monitors that comes with beSTORM is the bestorm_tail.pl. This script follows a provided file and looks for specific strings to pass to beSTORM to inform it that some failure/exception has occurred. One of the most common strings you can look for is SEGFAULT which if found inside a log file generated by a program, indicates that a segmentation fault (a crash, usually unhandled) has occurred.

Monitor template

If the service or device you are trying to test is not compatible with the beSTORM Monitor, but you can check its state using Python, consider using the monitor_template.py script (located in C:\Program Files (x86)\beSTORM\Monitors).

This script provides a blueprint for a simple monitor by filling the check_DUT_error() and connect_to_DUT() functions so you can run it as a command to monitor anything you want.

The monitor will connect to a beSTORM project and the device under test (DUT). If the DUT disconnects, the monitor will notify beSTORM to identify vulnerabilities and match them with the beSTORM packet that caused the disconnection.

1. If the DUT requires a prior connection or set up, fill the connect_to_DUT() function with the necessary code.

2. Fill the check_DUT_error() function with code that can check if your device is active or not. The monitor will use the function to check that it is connected, and then send an exception to beSTORM.

   Copy

   Example

   def check_DUT_error():
       if my_DUT_had_an_error:
           return True
       else
           return False
   
   The monitor will interpret a True output as a disconnection and send it to beSTORM

3. Create the beSTORM project.

   NOTE: It is recommended that you clear the Auto-start beSTORM scan now checkbox option so that the monitor can connect before the fuzzing is started.

4. Run the script from the command-line to connect the monitor to beSTORM and the DUT. You can use the following arguments:

   Argument	Description
   -A / --address -	The IP address of the beSTORM computer (this is the only mandatory argument).
   -H / -heartbeat_time -	The time between each heartbeat sent to beSTORM (default 1 second).
   -E / --checkerrors_time -	The time to wait before checking the DUT status (default is 1 second).
   -P / --persistent -	Activates persistent mode (instead of disconnecting upon finding a vulnerability, the monitor will keep trying to reconnect to the DUT) (default is False).
   -W / --persistent_waittime -	The total amount of time that the monitor will try to reconnect while in persistent mode (requires persistent mode) (default is 120 sec).
   -L / --log -	The path to a file where logs will be stored (default is None).

To add more command arguments, expand the get_args() function.

To modify the exception and heartbeat port from the default, change them in the send_exception() and start_notifier() functions respectively.

To modify the exception message in beSTORM, expand the send_exception() function.