Re: Foolin an IDS ?

[Zyzio <zyzio248 () o2 pl>]

Hi,

> Aside from looking at this the best way to learn to evade IDS/IPS
> is an understanding of the protocols that they are protecting.
> This doesn't mean just TCP/UDP; this also means things like MSRPC,
> HTTP, SSL and such.
I agree with you.

I think this is nice paper (about foolin HTTP by Whisker).
http://www.ussrback.com/docs/papers/IDS/whiskerids.html

and source 
http://sourceforge.net/projects/whisker/

Best Regards,
Chris 'Zyzio'


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------