topic So, about what IDS you are in Network Security

IPS testing with metasploit

josephium — Sun, 10 Mar 2019 10:47:39 GMT

Hi,

can anyone give a sample or a detailed example on how to test IPS with metasploit, no exploit is really working or triggering anything.

thanks

Re: IPS testing with metasploit

mhellman — Thu, 13 Sep 2007 14:49:58 GMT

I would focus on creating an environment where metasploit actually works (i.e. you can exploit an unpatched box). Then you can focus on IDS.

Re: IPS testing with metasploit

josephium — Mon, 17 Sep 2007 05:31:01 GMT

yes, but can anyone give a sample or a detailed example on how IPS stops a working exploit with metasploit or any other software

Re: IPS testing with metasploit

jdenis — Tue, 18 Sep 2007 13:19:09 GMT

easiest is to reverse engineer the signature details and craft packets based on the Sig RegEx for example.

For example, if a SIG is inspecting packets for "DNS" in traffic over 53/tcp, crafting a packet with this info will trigger the IPS...

Re: IPS testing with metasploit

mhellman — Tue, 18 Sep 2007 14:13:18 GMT

I have used metasploit to trigger alarms in promiscuous mode, but not inline. It's pretty much the same though. Get metasploit working. go through the list of available metasploit exploits and choose one that is:

1) exploitable on the test machine

2) detected by Cisco IPS

Test the exploit without IPS. One you have verified that it is working(during my test, I was creating a local user on a Windows box), test the exploit with IPS.

IPS testing with metasploit

Miroslav Berkov — Wed, 29 Oct 2014 04:05:09 GMT

Hi buddy,

what type of Cisco Systems Cisco Intrusion Prevention System (IPS) do you want to exploit?

So, about what IDS you are

Miroslav Berkov — Fri, 29 May 2015 21:09:05 GMT

So, about what IDS you are talking about? Cisco MARS or just Ettercap NG filters?