fscan (Anti-IDS cgi scanning implementation) v1.0
by f0bic [lowlevel] 2000
http://lowlevel.interniq.org

[fscan:(Table of Contents)]

1. General
   1.1 About fscan
   1.2 Disclaimer

2. Features
   2.1 Usage 
   2.2 Examplesyntaxes
   2.3 Bugs

3. Related
   3.1 Contacting
   3.2 Props


[fscan:(Index/Main)]



1. General

   1.1 About fscan
   
   fscan v1.0 is, as you might have guessed, an anti-ids cgi scanning implementation. 
   It makes use of various techniques in order to establish this anti-ids formatting and
   requesting. These features are explained in more detail in the following section.
   fscan v1.0 has sofar been tested on Linux (Red Hat 6.2, Slackware 7.0).

   1.2 Disclaimer
  
   Lowlevel may not be held liable for the use of and the content within lowlevel 
   *opensource* software applications. Use at your own risk.



2. Features

   2.1 Usage

   -- snippet of usage -- 

   	 [fscan] -- Usage:

   	 fscan.pl [..options..] [method] -h/-f <host/hostfile>

 	 -h : specifies host
  	 -f : specifies hostfile
         -l : enables logging (logs to either <host>.log or <hostfile>.log)

  	 -options-

  	 -e : URL encoding
  	 -d : dot insertion
         -r : random long url insertion
         -f : fake parameter insertion
       
  	 -methods-

	 -p : premature http request closure (slow)
	 -s : sequenced fragmentation attack
         none: fscan defaults to a regular http request

 
   -- end of snippet --
   
   All the options can be combined to form an anti-ids URI string. The methods relate to the different types of scanning methods themselves.
   If no scanning method is specified, it will default to a regular http request format scan.

   General:

   -h: specifies host
       single host scan
 
   -F: specifies hostfile
       reads from a hostfile

   -l: enables logging 
       when using -h and -l, fscan will log to <fscan-directory>/logs/<host>.log
       when using -F and -l, fscan will log to <fscan-directory>/logs/<hostfile>.log   

   Options:

   -e: URL encoding
       this option converts the uri string to hex

   -d: dot insertion
       this option adds ./ (local directory directive) to the request, so in other words, /cgi-bin would become /./cgi-bin

   -r: random long url insertion
       this option invokes the rand chargen and adds it to the request, since IDS mostly only look at the first 2-3 bytes of the request

   -f: fake parameter insertion
       this option invokes a rand to determine which html prefix is to be chosen, calls the rand chargen to generate a string which will be
       placed in the request

   Methods:

   -p: premature http request closure
       this method formats a empty http request, closes it, and then sends the actual request (tricks the IDS).

   -s: sequenced fragmentation attack
       this method sends different portions of the http request at various times. It basically breaks it up into pieces.

   fscan will default to a regular http request if no method is specified.


   2.2 Example syntaxes
 
   You can combine all of the options to form an anti-ids uri and then combine it with the preferred scanning method.
   fscan scans from a file called scan.file, containing the scripts to scan for, you can always add to this as you go along.
   Say fscan's gonna scan for /msadc/msadcs.dll and assuming all options are used, the encoding would go through the following stages:

   $ fscan -r -f -d -e -h www.victim.com

   1. regular: /msadc/msadcs.dll
   2. after random long url insertion: /tgyaoeolgzlzuhj/../msadc/msadcs.dll
   3. after fake parameter url insertion: /index.htm%3fmrqhkkwxwbaymmmnhjwwubyxugxlacfvdxx=/../tgyaoeolgzlzuhj/../msadc/msadcs.dll
   4. after dot insertion: /./index.htm%3fmrqhkkwxwbaymmmnhjwwubyxugxlacfvdxx=/./.././tgyaoeolgzlzuhj/./.././msadc/./msadcs.dll
   5. after hex encoding: /%2e/%77%65%6c%63%6f%6d%65%2e%68%74%6d%6c%%33%66%66%73%79%67%6f%70%69%6c%61%78%63%6d%6e%77%75%6f%68%73%7a%61%61%79%77
   %7a%77%6d%6d%70%6a%6d%67%6e%7a%68%68%63%63%79%6a%6a%73%68%68%62%6f%6b=/%2e/%2e%2e/%2e/%70%68%68%6b%78%63%78%69%73%76%7a%6b%70/%2e/%2e%2e/%2e/
   %6d%73%61%64%63/%2e/%6d%73%61%64%63%73%2e%64%6c%6c

   if you wanted to log: $ fscan -r -f -d -e -l -h www.victim.com

   if you wanted to specify a scaning method: $ fscan -r -f -d -e -p -h www.victim.com

   
   2.3 Bugs

   This is a first release of fscan, no bugs have been reported yet.
   If you do find a bug, lemme know. (f0bic@deadprotocol.org)


3. Related
    
   3.1 Contacting

   You can contact me either by email or on irc.
 
   email: f0bic@deadprotocol.org
   Undernet IRC: ./whois f0bic
   EFNet IRC: ./whois f0bic

   3.2 Props

   "Your kung-fu is strong ponskipper, but it's no match for the tekken warriors"

   the magic people/voodoo people:

   - the entire lowlevel group (especially jimjones; you chilly the most)
   - dead [ protocol ] society
   - wsno, zsh, securax
   
   && everyone else i've forgot to mention.
   
