Re: Re: Re: Re: HTTP traffic

[abhicc285 () gmail com]

Hi Abhishek Bhuyan, 

I think you are mixing every thing evasion false positive, exploit specific , bit exploit specific and vulnerability 
specific and you propose to be creative in writing exploit specific. Then you are claiming client side 
rules/signatures/filters give more false positive then web server side. Have you performed any study for your claims?? 
Can you please share the results with us ? What was you benchmark and the test setup for your study and claims ?

What do you mean by creative in writing exploit specific filter?


In response to your query about not being able to understand "to have a signature or rule which will create a region 
where other vulnerability specific rules can operate "

You have mentioned some thing about file format decoder. What is the purpose of file format decoder??





Abhishek Bhuyan (abhuyan gmail com) says ----

abhicc - I didn't understand what you mean by "to have a signature or
rule which will create a region where other vulnerability specific
rules can operate."
What I meant to tell is, there are more chances for false positive in
client-side HTTP. Understanding of protocol is necessary, but I don't
understand how it's related to false positive. There might be a
vulnerability in a webserver where if GET request is more than 256
characters might crash, doesn't mean there cannot be GET request with
more than 256 characters. (if you consider writing generic filters)

hirosh - We are not coming to the argument of exploit Vs vulnerability
nor about how fast we can write rules. Say tackling file format
vulnerabilities, you can do some sort of file format decoder, but that
too will be complex. Specially client-side, there are way too many
evasion tactics. You can also be creative in writing exploit specific
filters :) If we just look for AAAA, it will be hard to survive in the
industry :)

-Abhishek

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------