New answers tagged

5

There are various ways that comes handy with nmap to evade the basic rules of firewall or Intrusion detection system. 1) Packet Fragmentation: This option evade pattern matching detection technique. Since packet reassembly can be quite processor intensive, it's common for admin to disable it. In snort, fragmentation reassembly functionality is disabled ...


1

Nmap has several useful options which can help you evade a firewall/IDS. The effectiveness of these options will depend upon what you are up against, i.e. the system(s) and how they are configured. A properly configured, modern firewall will hinder your scans very effectively. A good breakdown of the nmap options you can use can be found here. Generally ...


0

Heuristics - whether used in AV, antimalware, or on a network - work on the premise of "straying from the norm." To avoid a lengthy post, please read "Understanding Heuristics." Now to give a non technical analogy that is applicable to most (networks, AV, etc): Imagine you are a security guard at a building (AV, network appliance, etc) and you are told: red ...


0

Heuristic scanner (for a file) can look/do for various things, including: sandboxing the application and analyse the behaviour (which files are created/deleled/modified, ...) looking for hooks to functions (direct disk writing, TCP socket binding, ...) strings like filenames (read/write of system files, ...) memory residence ability decryption of the ...


1

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in promiscuous mode. Usually the switch in a network will only send out packets on the port where the specific device is connected. This means that Snort has to be ...


1

Difficult to say without knowing the network topology, but I'd guess that you've not got snort set up on a SPAN port or similar. If your network is switched, then the snort box won't be receiving traffic which isn't either directed to it, or the broadcast. It may be listening in promiscuous mode, but if the packets aren't actually hitting the interface, ...


1

IDS, IPS, and Firewall are just names describing the capabilities and purpose and are not technical descriptions. The differences are often murky and how a device is called is also affected by marketing. Classical passive IDS like snort can be used inline too to prevent attacks and thus magically get an IPS. And IPS which are just used to watch but not ...


0

By definition this would be impossible with a perfect IDS. OTOH if we could write perfect systems we wouldn't need IDS.


1

The write-once property of logging systems are poorly written most of the time. Even you believe that your IDS is bulletproof: Don't forget that the attacker has full control over the attacked host. So, he can even control whether the host send packets to the IDS or not. Even if the packets are sent to the IDS, the network itself is mostly susceptible to ...


0

In my opinion, it would be possible if that certain attacker gained access to the device which has been whitelisted on the IDS, or whatever security system on that network.



Top 50 recent answers are included