Re: IDS Evaluation

[Raffael Marty <rmarty () arcsight com>]

For all the framework-aspects of your testing, there is Thor: 

http://thor.cryptojail.net

        -raffy

> On Mar 28, 2005, at 12:33 PM, Ron Gula wrote:
>
> > However, when you run vuln scanners against an IDS, you only really
> > test how an IDS detects vuln scanning. You should also add into you
> > test suite tools which conduct active exploitation.
>
> It's been said before, but I'll say it again.  Metasploit is a great 
> tool to use precisely for this purpose:
>
> http://www.metasploit.com/index.html
>
> Not that there aren't others...

-- 

Raffael Marty, GCIA, CISSP                    raffael.marty () arcsight com
Senior Security Engineer                    Content Team @ ArcSight Inc.
5 Results Way            Cupertino, CA  95014             (408) 864-2662

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------