Vulnerability Development mailing list archives
Re: [Full-Disclosure] Re: Bypassing "smart" IDSes with misdirected frames? (long and boring)
From: Michal Zalewski <lcamtuf () ghettot org>
Date: Fri, 28 May 2004 18:21:39 +0200 (CEST)
On Fri, 28 May 2004, Jim Bauer wrote:
The IDS will see not see a valid response to the "DATA" command (that is never received) so it will know it is still in SMTP command mode. Even if your not-so-smart IDS let this slip by, there is still the issue of "DEBUG" not being in a valid format for a header.
Which is precisely what I stated in the next paragraph. This is a naive example, but illustrates w far broader and non-SMTP-specific problem quite well. There are various protocols or attack vectors that do not involve challenge-response communications (even the problem of distinguishing between message body and message headers can be an example). Cheers, -- ------------------------- bash$ :(){ :|:&};: -- Michal Zalewski * [http://lcamtuf.coredump.cx] Did you know that clones never use mirrors? --------------------------- 2004-05-28 18:19 -- http://lcamtuf.coredump.cx/photo/current/
Current thread:
- Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: [Full-Disclosure] Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Oliver Friedrichs (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: [Full-Disclosure] Bypassing "smart" IDSes with misdirected frames? (long and boring) Aaron Turner (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Mike Frantzen (May 28)
- Re: [Full-Disclosure] Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 29)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Srini (May 29)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)