Re: Possible IDS-evasion technique

From: Sullo sq (sq@cirt.net)
Date: 02/16/02 

From: "Sullo  sq " <sq@cirt.net>
To: Alla Bezroutchko <alla@scanit.be>, vuln-dev@securityfocus.com
Date: Fri, 15 Feb 2002 18:05:14 -0500

0.9 was (is?) a valid HTTP version, so that is why Netscape/Apache (and most others) are answering the request properly. An IDS _should_ not care the HTTP version for a signature matching text on 'phf'. (of course, I suspect encoding /cgi-bin/phf string would also fool the IDS in this case...).

Sullo

> I've accidently found a way to bypass IDS detection for HTTP
> requests. I've seen this behaviour on some older version of
> IIS RealSecure network IDS and I wonder if this works on any
> other IDSes.
[snip]
> Request:
> GET /cgi-bin/phf HTTP/0.9
> Connection not reset, HTTP server replies "file not found"
>
> Apparently the last form of request allows to get a meaningful
> reply from HTTP server while IDS does not mind it.
>
> Apache and Netscape Entriprise will happily reply to the last
> form of request, didn't try it on other web servers.
>
> Alla.
>
>

____________________________________________________
http://www.cirt.net/
Home of the Nikto scanner, Default Passwords, Ports, SSIDs & more

Relevant Pages

  • making an http server
    ... i am making an http server ... transmit it to the browser as a fake HTML response ... web- this function returns the request back to the browser ... read from the socket the HTTP request ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Http server question
    ... hilz wrote: ... > I am experimenting with writing a simple http server. ... > request and then hangs. ...
    (comp.lang.java.programmer)
  • RE: OWA works from client but not from server
    ... Recently, the SBS domain users cannot access OWA from the SBS server, ... the error message may be one of the ... HTTP 400 - Bad Request ...
    (microsoft.public.windows.server.sbs)
  • Re: OWA works from client but not from server
    ... Recently, the SBS domain users cannot access OWA from the SBS server,   ... the error message may be one of the ... HTTP 400 - Bad Request ...
    (microsoft.public.windows.server.sbs)
  • Re: How to write something to a html textfield and send it?
    ... > No need for controlling any particular browser. ... I'm not familiar with HTTP user ... and building the request in your program. ... The server doesn't know anything about a textfield; ...
    (comp.programming)