8

I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and implement Intrusion Detection methods to detect and stop packets with malicious payloads. I would think that an IPS does not on it's own create any answer message (that could be used to fingerprint it) but rather either passes the packet or not. Then how can it be "fingerprinted"?

Perhaps a very first suggestion would be to send specifically crafted packets to a (e.g. web) server you know is connected beyond the IPS and based on the server's answers to infer on the IPS engine/rules. But is this practical? Is there a "proper" way to do it?

Cheers,

georgios

Improve this question
2
  • Note: you have it backwards. IPS prevents, IDS detects.
    – Jeff K
    Commented Feb 24, 2017 at 18:21
  • Actually, if you read it one more time you will see that Detection refers to a part of the IPS (the one that detects) rather than the whole: "Implement" Intrusion Detection methods.
    – George
    Commented Mar 3, 2017 at 15:09

3 Answers 3

Reset to default
3

You can read more about Active Filter Detection on the PureHacking website. The tool they are discussing is called osstmm-afd, available for download as a source tarball or NASL script. However, since that link isn't working -- I suggest you search for this tool elsewhere for now or email/contact PureHacking.

Improve this answer
1
  • This was more or less what i was looking for: not so much the tool itself but rather the network methodology it employs. Many thanks!
    – George
    Commented Apr 5, 2011 at 7:58
3

You probably would be interested in the research by Simple Nomad. He has done lots of research in this area and has been fingerprinting IPS devices for a while now.

Any in-line proxy that makes changes to the traffic can be fingerprinted. Understanding the signatures used by the IPS is important to create packets to thwart them or to validate an IPS is in stream modifying the packets.

Improve this answer
2

Sending different types of packets, including bogus ones, and judging the return values is how IP stacks are fingerprinted. Similarly, for web application firewalls, "WAFW00F" will do the same. Fingerprinting an IPS is no different. You find differences between in what IPS systems do for certain packets / attacks and use those to determine what you're probably looking at.

Perhaps one IPS sends an RST where another drops, etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .