IPS cannot detect/prevent signature

[Sarm_Chanatip]

Hi guys,

I'm trying to test prevent attack by IPS software blade with CVE-2006-2369 but no luck.

For this attack I use Radware Raptor Attack tool, Both of machines test is Radware Raptor tool, one act as Attacker and another one act as Server

Including Massscan Port Scanner not detect/prevent as well.

There is no any logs found on the log & monitor

But another signature is working fine such as (MS12-020) CVE-2012-0002

For this attack test I use Kali to be act as Attacker and another is windows7 machine.

Here is Access Control Rule Policy

Anyone here can advise me about scenario test, about 4-5 signatures prevent for example?

I would like to show customer that we can detect and prevent them from attack by known threat with CVE.

Thank you in advance. 

Appreciate every comments

Regards,

Sarm

[PhoneBoy]

What version of signatures are you running?

[Sarm_Chanatip]

I'm running with latest version, refer to screenshot below

Regard,

Sarm

[Timothy_Hall]

Are you sure the VNC auth bypass test was running on port 5900?  I didn't see the port number in your screenshots.  If you look at the advanced properties for that signature that is the only port it is looking on for that particular attack.

Just sweep scanning port 80 of a /24 may not be enough to trigger the masscan IP signature.  Try hitting all 65,535 TCP ports against 192.168.200.21 and see what happens.  If that still doesn't work make sure masscan is trying to pull an HTTP banner/response from the server(s) it is targeting.

In my IPS Immersion class I use the free nikto scanning tool to light up the IPS during labs; it is an old tool but very easy to use.  Your initial nikto scan will be 100% blocked, but once you override the "Nikto Security scanner" signature to Detect it will produce a few screenfulls of IPS logs every time you run it.

--
"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com

[Sarm_Chanatip]

Hi Timothy,

Are you sure the VNC auth bypass test was running on port 5900?

From masscan command, it looks like the port 5600 is not running on. 

root@kali:~# masscan -p5900 192.168.200.21

Starting masscan 1.0.3 (http://bit.ly/14GZzcT) at 2019-02-12 06:34:43 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [1 port/host]
root@kali:~#

Unfortunately, Radware Raptor Tool are only available for 3 services > HTTP, HTTPS, FTP

Regarding of "Nikto Security scanner" tool, let me check it out and will provide you with results test later

Thank you for comments

Regards,

Sarm