Network-Based IDS
A network-based IDS system monitors the traffic on its network segment as a data source. This is generally accomplished by placing the network interface card in promiscuous mode to capture all network traffic that crosses its network segment. Network traffic on other segments, and traffic on other means of communication (like phone lines) can't be monitored. Network-based IDS involves looking at the packets on the network as they pass by some sensor. The sensor can only see the packets that happen to be carried on the network segment it's attached to. Packets are considered to be of interest if they match a signature.Network-based intrusion detection passively monitors network activity for indications of attacks. Network monitoring offers several advantages over traditional host-based intrusion detection systems. Because many intrusions occur over networks at some point, and because networks are increasingly becoming the targets of attack, these techniques are an excellent method of detecting many attacks which may be missed by host-based intrusion detection mechanisms.
NULL Byte
A null byte refers to the character with the value 0x00 in hexadecimal (or %00 in URL encoding). It is used in many programming languages, especially C and C-derived languages, to indicate the end of a string. This means that when a null byte is encountered, the program treats it as the end of the input, ignoring any characters that follow.
Null byte injection is an exploitation technique where an attacker inserts a null byte into user-supplied data, often to bypass input validation or filtering mechanisms. This works because some programming languages or system functions (like those in C/C++) stop processing input at the null byte, while others (like PHP, Java, or Perl) may not treat it as special and continue processing the entire string.
Attackers can use null byte injection to:
Bypass file extension checks: For example, if an application appends ".php" to a filename, supplying "malicious.txt%00" can trick the system into only considering "malicious.txt" if the underlying code stops at the null byte.
Access restricted files: By injecting a null byte, attackers can manipulate file paths to access sensitive files like /etc/passwd on Unix systems.
Circumvent input validation: Filters that don't account for null bytes may allow otherwise forbidden input through, enabling further attacks such as directory traversal or code execution.
Example scenario:If a PHP application includes a file based on user input and appends ".php" to the filename, an attacker could exploit this with:
http://example.com/page.php?file=../../../../etc/passwd%00
The underlying C function might interpret it as /etc/passwd, ignoring the appended ".php" due to the null byte, and include the sensitive file.
