full-disclosure - IDS or IPS detection and bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Aug  8 14:09:06 2005
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: IDS or IPS detection and bypass

> I was trying to gain a reverse shell to a website the other day using
> a buffer overflow exploit, unfortunaetly it seems like they have some 

For legitimate (as it legal) security research, no doubt? :)

> is there a way to find out what exactly is running, an IDS or IPS, 
> and accordingly is there a way to bypass these systems

Social engineering is probably the best way to figure out what they're 
using .. call up the IT department and pretend to be selling another 
product. Chances are someone will spout off "oh .. we're already using 
'X' as an IDS".

As for bypass .. stuff along the lines of fragrouter is generally worth 
a shot (ie: attacks against their stream reassembly). If this webserver 
supports SSL, then setup a tunnel first and do your exploit that way .. 
IDS/IPS can't see into SSL sessions (unless they use a hardware 
offloader and put the IDS behind it).

~Mike.