Tag Info

Hot answers tagged

8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


5

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


1

Classical IDS work at the network layer and thus cannot handle encrypted connections like HTTPS which happen at the application or presentation layer (see OSI model). But, since you are interested only in detecting attacks by checking HTTP header fields (i.e. attacks at the application layer) you could built a (transparent) HTTP proxy instead and then do ...


1

Edit: just so I preempt comments along the lines you know nothing about how IPS works, I will stipulate that, and instead direct my answer towards the general method of inspecting HTTPS traffic. The short is answer is you can't. The long answer is you would have to perform MITM attacks against the connections. This can be done in cases when you only have ...



Only top voted, non community-wiki answers of a minimum length are eligible