Hack Attacks Testing How to Conduct Your - Back to Home

Figure 6.22 IDS Testing module.
CyberCop Scanner 177
Single Out-of-Order TCP Segment Test. This script determines whether your
IDS is capable of reconstructing data from network transactions when the packets
compromising those transactions are sent out of order.
Baseline (Single-Segment). This script determines whether your IDS is appropriately
configured to detect attacks in TCP network traffic. A variation is the
Baseline (Multiple-Segments) test.
Desynchronization Test. This script attempts to “desynchronize” your IDS from
a TCP connection used for carrying out an attack. By creating a false TCP connection
prior to carrying out a real attack, this test attempts to convince your IDS
that the attack-bearing connection is entirely invalid, thus preventing it from
monitoring the data exchanged in the connection. This specific test functions by
opening a connection, immediately resetting it, and opening a new connection
in its place.
All Out-of-Order TCP Segment Test. This script determines whether your IDS
is capable of reconstructing data from network transactions when the packets
compromising those transactions are sent out of order. Real TCP/IP network
software is capable of handling arbitrarily ordered packets; IDS is frequently
unable to do so.
TCP Sequence Number Verification Test (Jump-Up). This script attempts to
determine whether your IDS adequately verifies the sequence numbers on TCP
segments. Real TCP/IP network software discards TCP segments that do not
bear appropriate sequence numbers. IDS frequently does not and can be forced