Port scan detection avoidance

[o0hex0o]

Been evaluating a few ids devices (not that impressed to tell the truth ! ) and by accident found a common issue with the ones i am looking at.

They all detect nmap scans and nessus scans and flag them up, i changed the nmap-services file to a custom file i use with a very specific set of ports. None of the ids devices flagged up a scan for nmap

i have spoken to the vendors the general responses that they identify the scans by known finger prints from applications i.e the way nmap sequences the ports.the other thing they look for is connection to lots of ports from 1 ip over a set amount of time

Question is is there a proxy tool for BT to randomize the proxy address and allow more than just port 80 etc and a way to randomize the nessus scan ?

My view on the ids/ips is its not worth the investment and does not replace a correctly configured firewall and system.any thoughts on usefulness of ips?

[archangel.amael]

Originally Posted by o0hex0o

Question is is there a proxy tool for BT to randomize the proxy address and allow more than just port 80 etc and a way to randomize the nessus scan ?

My view on the ids/ips is its not worth the investment and does not replace a correctly configured firewall and system.any thoughts on usefulness of ips?

Start reading if you think that's as good as it gets.
You can do lots of things with nmap to help hide where you are coming from.
I am not going to tell you but if you look at the nmap man page it will tell you.
Course even then it might not work.

[thorin]

Both nmap and nessus have lots of builtin IDS/IPS avoidance options. Including random source ports, ftp or dns sourcing and bouncing, fragmenting packets, timing options, etc.

[MaXe Legend]

A timing option of -T0 helps a lot against many IDS's, but takes ages.

As thorin said, there's many options in both nmap and nessus. In fact so many
that eh, it would take a few days to explain them all I guess (in depth xD).

Even I don't know that much about IDS evasion since I haven't had the need to do it, yet.
But I look forward to the day that I'm actually going to need it! :-D