|
|
|
Testing Snort IDS with Metasploit vSploit Modules |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Testing Snort IDS with Metasploit vSploit Modules Par MetasploitLe [2011-07-09] à 00:53:50
Présentation : One of my key objectives for developing the new vSploit modules was to test network devices such as Snort. Snort or Sourcefire Enterprise products are widely deployed in enterprises, so Snort can safely be considered the de-facto standard when it comes to intrusion detection systems IDS . So much that even third-party intrusion detection systems often import Snort rules. Organizations are often having a tough time verifying that their IDS deployment actually work as intended, which is why I created several vSploit modules to test whether Snort sensors are seeing certain traffic. Because vSploit modules were made to trigger Snort alerts, so they don't obfuscate attacks to avoid detection. However, not every rule is used in every environment. For example, if you aren't using Microsoft Frontpage on your network, you likely won't want to use Snort's Frontpage rules. On the other hand, if you are running Frontpage you may not want to try exploiting it because it may affect the production system. Because of Metasploit Framework's flexibility, you can use the vSploit Generic HTTP Server module to host a small web server that answers all testing requests, so production systems won't be affected. You can run vSploit modules with a mix of Metasploit Framework, Metasploit Pro, and Metasploit Express, providing there is end-to-end network connectivity to the vSploit instances 2011-07-08_1602.png To try out the new vSploit modules, start up the vSploit Generic HTTP Server. 2011-07-08_1531_001.png Then launch Frontpage-related attack attributes 2011-07-08_1531.png Verify that the packets are being transmitted in Wireshark 2011-07-08_1542.png Finally, verify that Snort IDS sees the activity 2011-07-08_1551.png Metasploit vSploit Modules will be released at DEFCON 19.
Les mots clés de la revue de presse pour cet article : snort metasploit
Les videos sur SecuObs pour les mots clés : snort metasploit
Les mots clés pour les articles publiés sur SecuObs : snort metasploit
Les éléments de la revue Twitter pour les mots clé : snort metasploit
Les derniers articles du site "Metasploit" :
- Morto Another reason to secure local user accounts
- A Tale From Defcon and the Fun of BNAT
- How to update to Metasploit 4.0
- Metasploit Framework 4.0 Released
- Password Cracking in Metasploit with John the Ripper
- Metasploit 4.0 is coming soon
- ASCII Artists of the World UNITE
- Metasploit 4.0 The database as a core feature
- Metasploit Bounty Code, Sweat, and Tears
- Testing Snort IDS with Metasploit vSploit Modules
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
