Re: Worm generating network attack traffic?




I think it is important to note that:

(Traffic generated by vulnerability scanners) != (attack traffic)

While vulnerability assessment (VA) scanners can/will generate alerts
I would advise against using them if you want to do any kind of real
analysis. In fact, you probably don't want an IDS that is going to
mistake something like a service probe / banner grab (which is what
many VA checks actually are) with an actual attack. Any IDS that does
is going to be *highly* false positive prone...

FWIW, I have found tools such as Core Impact, Metasploit, and Canvas
to be far better options for testing IDS/IPS signature engines.

Just my .02,

-Greg


On Wed, 3 Dec 2008, Skyler.Bingham@xxxxxxxxxxxxxxxxxxxx wrote:

Nessus is useful for this as it has thousands of checks that will generate
a ton of attack traffic. The attacks are categorized by type, so you can
limit the generated traffic to specific types of attacks (Windows, FTP,
DoS, etc.). Metasploit can be used for very targeted attacks (specific
exploits) which can be tweaked with different evasion options which is
useful for testing IDSes. Both of these tools can be run from Windows.

http://www.nessus.org/nessus/
http://metasploit.org/

Skyler Bingham
GIAC {GSEC, GCIH, GCIA, GCFA}, CEH
(602) 957-1650 x1139

listbounce@xxxxxxxxxxxxxxxxx wrote on 12/02/2008 11:13:11 PM:


Hi
Does anyone know any tools which can be used to generate network attack
traffic ? It is for the purpose of testing IDSs OR for collecting offline
intrusion detection dataset like 1999 DARPA dataset. I have windows xp
installed so i need a tool or worm tool to generate network traffic so
that
i can collect by wireshark.
waiting ur reply.
Thanks>


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------





------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------



Relevant Pages

  • RE: Intrusion Prevention
    ... Coverage what can it detect; this covers basic attacks, ... IDS purchase. ... While doing these implementations and while working in an IDS vendor I ... sometimes we're told that we cannot see the testing methodology upfront. ...
    (Focus-IDS)
  • RE: Changes in IDS Companies?
    ... This means you need a standard IDS sitting behind it/next to it watching the ... Things like port scans and DoS attacks ... >>> If people are running insecure web servers, ... > Pretty sad state of affairs, when people don't update their patches at ...
    (Focus-IDS)
  • RE: Best Method(s) for signature verification.
    ... on this list - and other IDS lists - for the means to test their IDS ... When I say we use IDS Informer for our signature recognition testing, ... should point out that we do NOT use all the default attacks! ... (IIS attacks run against Apache web servers on Unix - "real ...
    (Focus-IDS)
  • Re: How to choose an IDS/FW MSS provider
    ... First, "recording everything" is not what IDS's were EVER meant for, ... others can create "audit" trails of every web request, every mail, every ... >detect attacks by inspecting layer 3 headers for prohibited IP ... >facility with an IDS or IPS deployed. ...
    (Focus-IDS)
  • Re: Alarming (was protocol analysis)
    ... Obviously, there are different ways to "detect" attacks, but John uses the ... no one should ever "rely" on any IDS for our ... As for Johns Metaphor of the motion sensor vs the pressure sensor, ... toward Intrusion Prevention as opposed to just Intrusion Detection. ...
    (Focus-IDS)