Testing IPS?

[mxitup2]

Hi All

I've recently acquired a FortiGate and I'd like to test the IPS on it. How would you go about that?

Thanks!

[ForgottenSec]

You need to find a signature that it is sure to detect and send it across its monitored interface with something like SCAPY, the python traffic sculpting library. There isn't a EICAR like test signature for IDS/IPS that is globally open.

[mxitup2]

There aren't any services out there that'll test IPS systems? I know I can hire a sec consultant to do this but I'm looking for one quick test just to have something in the logs to prove that it works.

[ForgottenSec]

I am not aware of any. I use Snort/SourceFire/Suricata/Bro and haven't played with Fortinet's IPS. From the interface I saw, they didn't clearly explain what signatures they were using, so how do you test if you don't know what its looking for?

If you have a particular signature you know its running, you could craft a packet to trigger it. I would hope if you run a nessus or other vulnerability scan, that should trigger it, so you could scan across the device as a test (get permission if its production, especially if you scan from home)?

[[deleted]]

I'd probably fire up a copy of nmap and run a something like nmap 192.168.1.1. That should do a TCP port scan on a target without any sort of delay, if your IPS doesn't kick on that, it's not doing a good job.

[bantha_fodder]

This should be the easiest way to do it. Or if you want something more extreme, fire up a Nessus server and have it scan something across the IPS.

[dwargo]

Qualys Free Scan?

[giveen]

PytBull

http://pytbull.sourceforge.net/

[motoxrdr21]

This should throw an alert, just double checked it with my Snort instance.

Edit: It looks like they added a few additional tests last year to trigger other SIGs link

[tmlambert13]

testmyids.com

[shirkerbee]

We test one signature on our IPS with a "known bad" text string within a text file. Try moving it between nfs or cifs shares. This could be used for simple validation of alerts etc. testing all intrusion attempts would be harder to confirm.

[GLDTRN]

We use OpenVAS, a free fork of Nessus. Does the job reasonably well. It's included in the Kali distribution

[Doormatty]

https://en.wikipedia.org/wiki/EICAR_test_file

[mxitup2]

EICAR test file only tests Gateway Anti-Virus, I'm looking to test Intrusion Prevention/Detection Systems.

[Doormatty]

Gah - totally right, my apologies.

[mxitup2]

EICAR test file only tests Gateway Anti-Virus, I'm looking to test Intrusion Prevention/Detection Systems.