Re: how to verify whether an attack attempt is successful?

[Huagang XIE <huagang () intruvert com>]

It depend on what kind of attack it is. 

For attack like Nimda, you need to check the HTTP response code and see 
if it return the interesting stuff. For DoS attack,
you  need to check if the server is crash which will not send back the 
response. For attacks which result into a root shell,
the way is to see if there is an interactive shell is runing.

But it also depends on the false positive, you need to make sure an IDS 
system has a lower false positve to do all these checking.

Huagang

Yan Zhai wrote:

> Is there any technology developed in this direction?
>
>