Penetration Testing mailing list archives
RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?
From: "xxradar" <xxradar () radarhack com>
Date: Wed, 26 Sep 2007 20:16:00 +0200
Hi, I've seen some firewalls that support inspection of fragmented traffic, but it does not mean they reassemble the traffic. This should be done at the endpoint (host or server, or proxy). I agree that it becomes more difficult to 'fool' firewalls or IPS/IDS with fragmentation, but myself I had a lot of success with fragroute to bypass IDS/IPS systems that were able to decrypt SSL traffic. Very few (not to say none ...) were able to handle fragroute. If they already succeeded to support IP fragmentation, they certainly messed up when using the TCP segmentation features present in fragroute. Regards, ---------------------------------------------------------------------------- --------------------------------- Philippe Bogaerts mailto:xxradar () radarhack com http://www.radarhack.com http://blog.securityprofessional.be/ http://www.linkedin.com/in/xxradar NEW http://www.radarhack.com/dir/papers/Getting started with OWASP WebGoat 4.0 and SOAPUI.pdf -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Shenk, Jerry A Sent: Wednesday, September 26, 2007 1:06 PM To: seclt yuri; Harry Hoffman Cc: pen-test () securityfocus com Subject: RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Well, like almost any security vulnerability, attacks against it are useless unless it works! There are all kinds of "old attacks" that end up being valid attack vectors all the time. You have no idea if people have designed the network you are testing correctly or not. One other point here - fragmentation attacks and what can get as a result is something that you might want to test in your lab. If you test it in a controlled environment, you will be better able to know if it's working and what you can expect to gain when you use it in the field. -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of seclt yuri Sent: Tuesday, September 25, 2007 10:29 PM To: Harry Hoffman Cc: pen-test () securityfocus com Subject: Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Yes but this effectively means that fragmentation attacks are useless if launched across the 'Net and when performing a penetration test without local access. Also, even internal host systems are usually segregated from servers and server vlans by a firewall, so even then, I can't see how fragmentation attacks would be effective. The only scenario that I can think of would be within the same subnet or vlan where traffic doesn't pass through a firewall. Please correct me if I am wrong. Thank you. --- Harry Hoffman <hhoffman () ip-solutions net> wrote:
yep, unfortunately not enough people using host based firewalls and alot of attacks happen inside of where the firewall protects (i.e. local lan) seclt yuri wrote:Hi, I was just reading up on fragmentation attacksusingfragrouter and fragrouter as a mean of IDS/IPS evasion. However, since almost all firewalls both commercial and free (iptables for examples) nowhavesupport for fragment reassembly, are fragmentation attacks still effective? Thanks.
________________________________________________________________________ ____________
Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solutionFREE today!http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads
------------------------------------------------------------------------
________________________________________________________________________ ____________ Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7 ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------ **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business. ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------ No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.488 / Virus Database: 269.13.30/1030 - Release Date: 9/25/2007 8:02 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.488 / Virus Database: 269.13.30/1030 - Release Date: 9/25/2007 8:02 AM ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Are Fragmentation Attacks Still Used for IDS/IPS Evasion? seclt yuri (Sep 25)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Harry Hoffman (Sep 25)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? seclt yuri (Sep 25)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Harry Hoffman (Sep 25)
- RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Philippe Bogaerts (Sep 26)
- RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Shenk, Jerry A (Sep 26)
- RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? xxradar (Sep 26)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? seclt yuri (Sep 25)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? Harry Hoffman (Sep 25)
- <Possible follow-ups>
- Re: Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? vijay . upadhyaya (Sep 30)
- Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion? seclt yuri (Sep 30)