Tag Info

New answers tagged

0

For intrusion detection you will definitely want to monitor your access.log and error.log files for this web app. I would look out for: Unusually high traffic. Figure out what a normal amount of traffic is based on your access.log and set a monitor to alert you if you suddenly get a much greater amount (e.g. 10 times more requests) that could indicate ...


0

Full documentation on the latest version of OSSEC is here: http://ossec-docs.readthedocs.org/en/latest/index.html The documentation is a little light and I found I had to do a lot of trial and error to get it to do exactly what I wanted. My recommendation, especially if you're new to the software, would be to download the Server Virtual Appliance here: ...


0

Rather than using google to find answers for "How to avoid IDS", turn it around. Search for IDS and read about the various IDS solutions. To answer this question, you need to first define what is meant by IDS. Not what the letters stand for, but what you understand the term refers to and the main techniques used. You will find these fall into a few typical ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


5

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


1

Classical IDS work at the network layer and thus cannot handle encrypted connections like HTTPS which happen at the application or presentation layer (see OSI model). But, since you are interested only in detecting attacks by checking HTTP header fields (i.e. attacks at the application layer) you could built a (transparent) HTTP proxy instead and then do ...


0

According to NIST - Special Publication 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS)1: Network-based IDPSs cannot detect attacks within en crypted network traffic, including virtual private network (VPN) connections, HTTP over SSL (HTTPS), and SSH sessions. As previously mentioned, some network-based IDPSs can do some ...


1

Edit: just so I preempt comments along the lines you know nothing about how IPS works, I will stipulate that, and instead direct my answer towards the general method of inspecting HTTPS traffic. The short is answer is you can't. The long answer is you would have to perform MITM attacks against the connections. This can be done in cases when you only have ...


0

For testing firewalls, I generate my own scripts using hping. One of the options is to fragment traffic (-f) and you can set the data size (-d).



Top 50 recent answers are included