Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit.

If I modify the exploit code, are there IPS/IDS which will still detect this attack?

share|improve this question
That needed some editing. – rook Jul 23 '12 at 3:57
up vote 7 down vote accepted

It depends. An IDS might detect the vulnerability, or it might not, depending upon whether it has the ability to detect exploitation of the vulnerability itself independent of the exploit payload.

In general, IDS systems can try to detect attacks either by trying to recognize the payload of an attack ("exploit code"), or by trying to recognize the exploitation of the vulnerability (the vector itself). If you modify the payload, then you might avoid detection by the former style of signature, but not the latter.

You asked us to assume IDSs work by detecting only the former, but this is not an accurate representation of how IDSs actually work in real life. In other words, you asked to make an assumption that is not actually accurate.

You might want to read about IDS evasion attacks. See, e.g., the classic research papers:

Finally, in general, please remember that no IDS ever guarantees to detect all attacks. They detect some attacks, but not all. They are far from a perfect defense. As always, if you have the option to fix the vulnerability itself, that is a more reliable defense than relying upon an IDS to detect exploitation of the vulnerability.

These comments all apply to IPS systems as well (thanks to @Everett for pointing this out).

share|improve this answer
This is an excellent answer, I only want to add that even the vector detection can sometimes be circumvented. As a simple example, consider path traversal attacks (see A poor validation engine may block simple HTML encoding, but not double encoding, e.g. %2e%2e\ (representing ..) would be blocked, but not %252e%252e%255c (representing ..) may not be. On the first validation pass, each %25 is decoded as %, leaving the first string intact, but beyond scrutiny. – dblanchard Nov 12 '15 at 16:35

You may want to consider a host based IPS like OSSec. It works for Linux, BSD, OS X, and Windows. This is designed to analyze what is being done to a specific system (the one that OSSec is installed on). You still don't get a guarantee, but it is a step up from an IDS.

share|improve this answer
This doesn't really answer the question. OP wasn't asking for IDS recommendations. – Polynomial Jul 23 '12 at 7:51

IDS looks for patterns in traffic and is based on signatures. If the exploit does not contain the payload or does not use the traffic pattern the IDS is looking for, then the exploit will pass.

You can see, then, that there might not need to be software to change an exploit to pass an IDS. Sometimes, simply encoding the exploit to exclude certain characters can work. Or, encrypt the traffic so that the IDS cannot parse the code.

For the best case, use the IDS in your test environment, load the signatures, then fire your exploit. See what rules are hit and how those rules are written. That way, you can see what needs to change in your exploit code.

share|improve this answer

It depends on what type of vulnerability and what type of exploit you are working on. You are changing the exploit code, that means it should actually result a change in the sequence of bits in the packet's payload or application's data flow using the given protocol. Because that is what the IPS will look for. There are vulnerabilities that can only work with one exploit code, some can take a variation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.