Which Vulnerable target should I install to Splunk Forwarder?

[Mc_Guard]

Hello everyone. I installed Splunk Enterprise free edition on the Ubuntu machine. I want to install splunk forwarder on a vulnerable machine and deploy it to the Ubuntu machine. I want to attack the vulnerable machine over Kali linux and examine the logs falling to Splunk. Can you help me which vulnerable machine I can install Splunk Forwarder. 

[Gr0und_Z3r0 · Accepted solution]

Hi @Mc_Guard ,

In addition to what @richgalloway mentioned. Splunk will just be a tool to collect logs from any source that generates machine data. In terms of identifying machines for attacks and identifying and doing your pentest, I would recommend getting the images of vulnerable images from https://www.vulnhub.com/.

Please be sure on how and what you'll be doing it on and ensure you run these images in a sandboxed environment. You'll need to bake these images with Splunk Universal Forwarder depending on the OS type and configure the route to successfully send the event logs into your Splunk instance. 

Another thing to note, you'll need to know what kind of attack you'll be performing and where you'll be expecting those events/logs to be generated. As these are the paths you'll need to configure for the Splunk UF setup to forward the logs.

Note: Do not run these vulnerable images in cloud instances, there's a high chance it will be identified and reported and your account may be blocked. Better to run them on virtual boxes in a controlled sandbox environment.

~ If the reply helps, a Karma upvote would be appreciated.

[Mc_Guard]

Thank you for sharing your experience and knowledge.

[richgalloway]

All machines are vulnerable in some way so just install Splunk Forwarder on whatever you have available.  Whatever machine to select, be aware that Splunk and Splunk Forwarder do not detect vulnerabilities.  You can create reports in Splunk that report vulnerability information, but the vulnerabilities themselves must be detected by another program and reported to Splunk.

[Mc_Guard]

Thank you for sharing your experience and knowledge