Re: Foolin an IDS ?

[Graeme Connell <gconnell () middlebury edu>]

Here are a few links to get you started:

This is a Phrack article, possibly the one you've already seen?
http://www.phrack.org/show.php?p=61&a=9

Here's a paper on an engine created to detect workarounds in NIDS:
www.cs.wisc.edu/wisa/papers/acsac04/RJM04.pdf

Check out the bibliography of that paper, too.  There's probably some 
more useful stuff in there.

                --Graeme Connell

Sec Traq wrote:
> Hi,
> I have read a couple of papers on how to fool and IDS. One of them from phrack. I find the subject really interesting 
> and am considering it as an MSc. project, but i need more advanced and technical papers. If any1 could advice ur help 
> would be appriciated.
> Thnx
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------