Possible IDS-evasion technique

From: Alla Bezroutchko (alla@scanit.be)
Date: 02/15/02 

Date: Fri, 15 Feb 2002 18:20:11 +0100
From: Alla Bezroutchko <alla@scanit.be>
To: vuln-dev@securityfocus.com

I've accidently found a way to bypass IDS detection for HTTP
requests. I've seen this behaviour on some older version of
IIS RealSecure network IDS and I wonder if this works on any
other IDSes.

That particular IDS was set up to reset connections that match
attack signatures, so I could see immediately if it was detected
or not:

Request:
GET /cgi-bin/phf HTTP/1.0
Connection reset

Request:
GET /cgi-bin/phf
Connection reset

Request:
GET /cgi-bin/phf HTTP/12.0
Connection not reset, HTTP server replies "version not supported"

Request:
GET /cgi-bin/phf HTTP/0.9
Connection not reset, HTTP server replies "file not found"

Apparently the last form of request allows to get a meaningful
reply from HTTP server while IDS does not mind it.

Apache and Netscape Entriprise will happily reply to the last
form of request, didn't try it on other web servers.

Alla.

Relevant Pages

  • RE: Possible IDS-evasion technique
    ... Just a thought - I'm not familar with RealSecure... ... Connection: close ... HTTP/1.1 400 Bad Request ... That particular IDS was set up to reset connections that match attack signatures, so I could see immediately if it was detected or not: ...
    (Vuln-Dev)
  • Re: Form Validation (revisited)
    ... Geoff & Jock ... with the name "reset" - I similarly test for that and reset "emailAddress" ... >> And I'm not sure what you mean by 'usability blunder'. ... > The fact that a submit button (which causes a request to be made) is ...
    (comp.lang.php)
  • Re: I receive the same email from "Microsoft Customer Support" ev
    ... Reset your Windows Live password? ... We received your request to reset your Windows Live password. ... Follow the instructions on the web page that opens. ...
    (microsoft.public.security)
  • Re: Attributes that Update during Computer logon
    ... You mention that the computer may request its password to be reset, ... Finally you mentioned that "lastLogon" was not replicated but is the ... roving disconnected for some time and it won't matter. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Attributes that Update during Computer logon
    ... You mention that the computer may request its password to be reset, ... Finally you mentioned that "lastLogon" was not replicated but is the ... This attribute is also Integer8 and is replicated. ...
    (microsoft.public.windows.server.active_directory)