[Full-Disclosure] shellcode encoders & IDS
nd at felinemenace.org
Sat Oct 4 03:02:40 BST 2003
i was thinking that too protect ourselves from unknown attacks, there must
be a way to detect things such as shellcode decoders in payloads. after a
bit of research, i have compiled this small list of publicly availiable
encoder/decoder systems in the hope that snort or another IDS project
would build rules for them. The following list is the app the encoder is
featured in, the author and the type.
shellforge.py: Phillip Biondi - Xor and Alpha Numeric
Pex.pm: HDM & HSJ - Xor
CANVAS: dave aitel - Additive and Unicode
(not publicly available but recently leaked)
Hellkit: stealth - Xor
rix - AlphaNumeric
and im sure there are plenty more. If anyone know's of any other public
encoder/decoder systems, send them too me so i can complete a exhastive
list and so that once again,mutant payloads will be detected.
Full-Disclosure is hosted and sponsored by Secunia.