RE: interesting paper on testing sig-based IDS

[Jose Maria Lopez Hernandez <jkerouac () bgsec com>]

El jue, 03-03-2005 a las 08:48 -0500, Kyle Quest escribió:
> Mick,
> Have you thought about using fragroute/fragrouter for that???
> They do a good job with TCP. It seems like that's what you
> are asking for when you talk about TCP in your email
>
> Kyle

You can also use nikto and nessus to do that. Both have a lot
of options to fool the HTTP preprocessor, and nessus also has
options to fool the IPS with fragmented packets and so.

Regards

-- 

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------