Re: [Full-disclosure] IDS or IPS detection and bypass

From: Michael Holstein (michael.holstein_at_csuohio.edu)
Date: 08/08/05

  • Next message: Greg: "Re: [Full-disclosure] Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re:[Full-dicklosure] Weird URL" 
    Date: Mon, 08 Aug 2005 09:07:20 -0400
To: full-disclosure@lists.grok.org.uk

    > I was trying to gain a reverse shell to a website the other day using
    > a buffer overflow exploit, unfortunaetly it seems like they have some

    For legitimate (as it legal) security research, no doubt? :)

    > is there a way to find out what exactly is running, an IDS or IPS,
    > and accordingly is there a way to bypass these systems

    Social engineering is probably the best way to figure out what they're
    using .. call up the IT department and pretend to be selling another
    product. Chances are someone will spout off "oh .. we're already using
    'X' as an IDS".

    As for bypass .. stuff along the lines of fragrouter is generally worth
    a shot (ie: attacks against their stream reassembly). If this webserver
    supports SSL, then setup a tunnel first and do your exploit that way ..
    IDS/IPS can't see into SSL sessions (unless they use a hardware
    offloader and put the IDS behind it).

    ~Mike.
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Greg: "Re: [Full-disclosure] Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re:[Full-dicklosure] Weird URL"