Class: Msf::Plugin::IPSFilter

Inherits:
Msf::Plugin show all
Defined in:
plugins/ips_filter.rb

Overview

This class hooks all sockets created by a running exploit and prevents data from being sent that matches a known IPS signature.

Defined Under Namespace

Classes: IPSSocketEventHandler

Instance Attribute Summary

Attributes inherited from Msf::Plugin

#opts

Attributes included from Framework::Offspring

#framework

Instance Method Summary collapse

Methods inherited from Msf::Plugin

#add_console_dispatcher, create, #flush, #input, #output, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #remove_console_dispatcher

Constructor Details

#initialize(framework, opts) ⇒ IPSFilter

Returns a new instance of IPSFilter.



39
40
41
42
43
 
# File 'plugins/ips_filter.rb', line 39

def initialize(framework, opts)
  super
  @ips_eh = IPSSocketEventHandler.new
  Rex::Socket::Comm::Local.register_event_handler(@ips_eh)
end

Instance Method Details

#cleanup ⇒ Object 



45
46
47
 
# File 'plugins/ips_filter.rb', line 45

def cleanup
  Rex::Socket::Comm::Local.deregister_event_handler(@ips_eh)
end

#desc ⇒ Object 



53
54
55
 
# File 'plugins/ips_filter.rb', line 53

def desc
  "Scans all outgoing data to see if it matches a known IPS signature"
end

#name ⇒ Object 



49
50
51
 
# File 'plugins/ips_filter.rb', line 49

def name
  "ips_filter"
end