SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsThe purpose of the paper is to analyze the effectiveness of Bro IDS in detecting web application attacks. In order to detect known web-based attacks, intrusion detection systems are usually equipped with a large number of signatures. They can however be fooled by obfuscated input techniques and allow the query to pass unfiltered to the web application. The paper will explore the use of application layer knowledge of data as well as signatures to detect common web attacks using Bro IDS scripting language.