https://insinuator.net/tags/sourcefire/ Recent content in Sourcefire on Insinuator.net - Bold Statements Hugo en-us Sat, 18 Oct 2014 00:00:00 +0000 https://insinuator.net/2014/10/a-please-dont-waste-my-time-approach-and-the-sourcefire/snort-evasion/ Sat, 18 Oct 2014 00:00:00 +0000 https://insinuator.net/2014/10/a-please-dont-waste-my-time-approach-and-the-sourcefire/snort-evasion/ <p>This is a guest post from <a href="http://www.secfu.net/about-me/">Antonios Atlasis</a>.</p> <p>Yesterday we (Rafael Schaefer, Enno and me) had the pleasure to deliver together our talk at BlackHat Europe 2014 named <a href="https://www.blackhat.com/eu-14/briefings.html#evasion-of-high-end-idps-devices-at-the-ipv6-era">Evasion of High-End IDPS Devices at the IPv6 Era</a> (by the way, latest slides can be found <a href="https://www.ernw.de/download/Atlasis_Rey_Schaefer_BHEU_2014_Evasion_of_HighEnd_IPS_Devices.pdf">here</a> and the white paper <a href="https://www.ernw.de/download/eu-14-Atlasis-Rey-Schaefer-briefings-Evasion-of-HighEnd-IPS-Devices-wp.pdf">here</a>). In this talk we summarised all the IDPS evasion techniques that we have found so far. At previous blogposts I had the chance to describe how to evade <a href="http://www.insinuator.net/2014/08/evading-idps-by-combining-ipv6-extension-headers-and-fragmentation-features-the-story-of-my-life/">Suricata</a> and <a href="http://www.insinuator.net/2014/05/a-novel-way-of-abusing-ipv6-extension-headers-to-evade-ipv6-security-devices/">TippingPoint</a>. In this post I am going to describe some other techniques that can be used to evade <a href="https://www.snort.org/">Snort</a>, and its companion commercial version, <a href="http://www.sourcefire.com/">Sourcefire</a>. The tool used to evade these IDPS is –  what else – <a href="http://www.insinuator.net/2014/10/chiron-an-all-in-one-ipv6-penetration-testing-framework/">Chiron</a>.</p>