- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- IPS cannot detect/prevent signature
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IPS cannot detect/prevent signature
Hi guys,
I'm trying to test prevent attack by IPS software blade with CVE-2006-2369 but no luck.
For this attack I use Radware Raptor Attack tool, Both of machines test is Radware Raptor tool, one act as Attacker and another one act as Server
Including Massscan Port Scanner not detect/prevent as well.
There is no any logs found on the log & monitor
But another signature is working fine such as (MS12-020) CVE-2012-0002
For this attack test I use Kali to be act as Attacker and another is windows7 machine.
Here is Access Control Rule Policy
Anyone here can advise me about scenario test, about 4-5 signatures prevent for example?
I would like to show customer that we can detect and prevent them from attack by known threat with CVE.
Thank you in advance.
Appreciate every comments
Regards,
Sarm
- Tags:
- ips protections
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of signatures are you running?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm running with latest version, refer to screenshot below
Regard,
Sarm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure the VNC auth bypass test was running on port 5900? I didn't see the port number in your screenshots. If you look at the advanced properties for that signature that is the only port it is looking on for that particular attack.
Just sweep scanning port 80 of a /24 may not be enough to trigger the masscan IP signature. Try hitting all 65,535 TCP ports against 192.168.200.21 and see what happens. If that still doesn't work make sure masscan is trying to pull an HTTP banner/response from the server(s) it is targeting.
In my IPS Immersion class I use the free nikto scanning tool to light up the IPS during labs; it is an old tool but very easy to use. Your initial nikto scan will be 100% blocked, but once you override the "Nikto Security scanner" signature to Detect it will produce a few screenfulls of IPS logs every time you run it.
--
"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Timothy,
Are you sure the VNC auth bypass test was running on port 5900?
From masscan command, it looks like the port 5600 is not running on.
root@kali:~# masscan -p5900 192.168.200.21
Starting masscan 1.0.3 (http://bit.ly/14GZzcT) at 2019-02-12 06:34:43 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [1 port/host]
root@kali:~#
Unfortunately, Radware Raptor Tool are only available for 3 services > HTTP, HTTPS, FTP
Regarding of "Nikto Security scanner" tool, let me check it out and will provide you with results test later
Thank you for comments
Regards,
Sarm