OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Darryl Luff (darryl_at_snakegully.nu)
Date: Fri Oct 18 2002 - 06:45:01 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    > Jeremy Junginger wrote:

    > Has anyone had success in creating a program that uses IP/TCP/UDP/ICMP
    > header information to transmit encoded messages from one host to
    > another? Shortly after reading

    Hi Jeremy,

    As you say there are usually easier ways. If you're inside a firewall
    connecting out, you can just use http, https or email through their
    existing systems. If you're outside trying to connect in, I think that
    the main problem is getting your packets in to where the target system
    can see them. If you can do that, you can encode it however you want.

    I imagine that the easiest way would be to pick an unknown IP or TCP
    option number and insert your own options field into the IP or TCP
    header. This keeps your data separate from the TCP connection data. I
    think that an option field can be up to 253 bytes of data?

    Do any IDS systems trigger on unrecognised option fields?

    Darryl Luff