1. Bypassing Network Security: Evading IDSs, Honeypots, and Firewalls

2.  IDS vs IPS  Use packet sniffers  Host Based vs Network Based  Signature Based vs Anomaly Based

3.  Bypassing an IDS  Change the traffic (eg: HTTP instead of ICMP)  Session Splicing  Inserting extra data  Obfuscating addresses  Use encryption  Session hijacking

4.  ADMutate  Rewrites a script  Snort  Real-time packet sniffer  HIDS  traffic-logging tool  Both Linux and Windows

5.  Firewalls: Hardware vs Software  Honeypots  Specter, KFSensor, Nessus  Bypassing honeypots  Reverse www shell  Compromise an internal system that connects via port 80 to hacker’s system  Use anti-honeypot software to warn of honeypot systems

6.  Honeypot Study Guide:  http://ethics.csc.ncsu.edu/abuse/hacking/honeypo ts/study.php http://ethics.csc.ncsu.edu/abuse/hacking/honeypo ts/study.php