Full Disclosure mailing list archives
Re: IDS or IPS detection and bypass
From: Michael Holstein <michael.holstein () csuohio edu>
Date: Mon, 08 Aug 2005 09:07:20 -0400
I was trying to gain a reverse shell to a website the other day usinga buffer overflow exploit, unfortunaetly it seems like they have some
For legitimate (as it legal) security research, no doubt? :)
is there a way to find out what exactly is running, an IDS or IPS, and accordingly is there a way to bypass these systems
Social engineering is probably the best way to figure out what they're using .. call up the IT department and pretend to be selling another product. Chances are someone will spout off "oh .. we're already using 'X' as an IDS".
As for bypass .. stuff along the lines of fragrouter is generally worth a shot (ie: attacks against their stream reassembly). If this webserver supports SSL, then setup a tunnel first and do your exploit that way .. IDS/IPS can't see into SSL sessions (unless they use a hardware offloader and put the IDS behind it).
~Mike. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- IDS or IPS detection and bypass Ahmad N (Aug 08)
- Re: IDS or IPS detection and bypass Michael Holstein (Aug 08)
- Re: IDS or IPS detection and bypass Frank Knobbe (Aug 08)
- Re: IDS or IPS detection and bypass fd (Aug 08)
- Re: IDS or IPS detection and bypass Ivan . (Aug 09)