Build a beacon and find it by shape

short · 50 min · Objective 1.2

Task

Write a harmless beacon -- a script you wrote yourself that does nothing but make a request on a timer -- then find it in your own traffic using only timing and volume, without knowing its destination in advance.

Steps

  1. On the Windows VM, run a listener: python -m http.server 8080.
  2. On the Linux VM, write a beacon and start it in the background:

while true; do curl -s -m 3 http://10.10.10.20:8080/status > /dev/null; sleep 60; done &

  1. Start a capture: sudo tcpdump -i eth0 -w /tmp/beacon.pcap. While it runs, also browse the listener normally a few times, at irregular intervals, so the capture contains both shapes.
  2. After twenty minutes, stop the capture. Now analyse it as though you did not know what you planted: group connections by destination, count them, and compute the gaps between successive connections.
  3. Add jitter -- change the beacon's sleep to sleep $((50 + RANDOM % 20)) -- and capture another twenty minutes. Redo the analysis and see how much harder it got.

Verify

tshark -r /tmp/beacon.pcap -T fields -e frame.time_epoch -e ip.dst -Y "tcp.flags.syn==1 && tcp.flags.ack==0" | awk '{print $2}' | sort | uniq -c | sort -rn | head -3
tshark -r /tmp/beacon.pcap -T fields -e frame.time_epoch -Y "tcp.flags.syn==1 && tcp.flags.ack==0 && ip.dst==10.10.10.20" | awk 'NR>1{print int($1-p)} {p=$1}' | sort -n | uniq -c

The first must show one destination with far more connections than the rest. The second is the proof: the interval histogram must pile up on a single value near 60. A human browsing produces a spread; a timer produces a spike. That histogram is what a beaconing detection actually computes.

Notes

Run the jittered capture through the same histogram. The spike widens into a band but does not disappear, which is why jitter raises the cost of detection without removing it -- the regularity is in the distribution, not in any one interval.

Keep this capture too. The packet analysis and hunting labs both use it.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.