Timeline for Getting reverse shell from firewalled target
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 12, 2021 at 10:30 | comment | added | schroeder♦ | "too small" can only be determined by the specifics of the protections in place. Knowing the name and type of protections, you can look up its documentation or get a version for yourself and test at home (definitely "safe-to-fail") | |
| Aug 12, 2021 at 10:29 | comment | added | schroeder♦ | Don't think "perfect" think "optimal". You might want to know how often the logs are checked, if there is a SIEM, if the firewall is a next-gen firewall and adaptive to anomalies, etc. | |
| Aug 12, 2021 at 10:28 | comment | added | hyogy | Speaking of detection, the malware also splits the output of the commands in small packets, to make less suspicious traffic network, but I know that some IPS/IDS may give an alert if a packet is too small ( for example, the packets size it sends are between 30 - 40 bytes ). Are they too small? | |
| Aug 12, 2021 at 10:13 | comment | added | hyogy | I did not provide more details because its just a doubt I came up while studying, this is not based on a real scenario. OFC in a blast is like firing fireworks, and as you say, too slow also could be a problem, so how could I understand with the information gathering the perfect timing for each connection? | |
| Aug 12, 2021 at 9:41 | history | answered | schroeder♦ | CC BY-SA 4.0 |