topic cisco IPS skipfish detection in Network Security

cisco IPS skipfish detection

ngtransge — Sun, 10 Mar 2019 12:52:53 GMT

Hello,

Is there any signature to detect skipfish kind of application with Cisco IPS, when web server is running https ?

Or is it possible to write own custom signatures and with engine will do that ?

Re: cisco IPS skipfish detection

Karsten Iwen — Sun, 27 Jan 2013 14:39:29 GMT

When your site is running HTTPS, then your IPS doesn't have any insight into the L7-communication. But that's needed to see what an Web-application-scanner is doing.

I've implemented a workaround for a similar situation the following way with the ASA-IPS-module:

You deploy two DMZs: One with an HTTPS terminating reverse-proxy. This reverse-proxy forwards the traffic to the real HTTP-Server in another DMZ. Now you can inspect the cleartext-traffic between the Proxy-DMZ and the Server-DMZ with the ASA-IPS. With an IPS-appliance you could plug a promiscous interface into the server DMZ to only see the clear traffic.

After the sensor sees the clear-text, there are numerous build-in signatures to detect these scannings.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Re: cisco IPS skipfish detection

anikapur — Mon, 28 Jan 2013 05:34:57 GMT

If you have a load balancer with virtual sensor support, the IPS can be placed between two virtual sensors. The virtual sensor decrypts and forwards traffic to the IPS. The IPS forwards the traffic to the second virtual sensor which re-encrypts the flow.