Class: Msf::Plugin::IPSFilter

Inherits:
Msf::Plugin show all
Defined in:
plugins/ips_filter.rb

Overview

This class hooks all sockets created by a running exploit and prevents data from being sent that matches a known IPS signature.

Defined Under Namespace

Classes: IPSSocketEventHandler

Instance Attribute Summary

Attributes inherited from Msf::Plugin

#opts

Attributes included from Framework::Offspring

#framework

Instance Method Summary collapse

Methods inherited from Msf::Plugin

#add_console_dispatcher, create, #flush, #input, #output, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #remove_console_dispatcher

Constructor Details

#initialize(framework, opts) ⇒ IPSFilter

Returns a new instance of IPSFilter.



31
32
33
34
35
 
# File 'plugins/ips_filter.rb', line 31

def initialize(framework, opts)
  super
  @ips_eh = IPSSocketEventHandler.new
  Rex::Socket::Comm::Local.register_event_handler(@ips_eh)
end

Instance Method Details

#cleanup ⇒ Object 



37
38
39
 
# File 'plugins/ips_filter.rb', line 37

def cleanup
  Rex::Socket::Comm::Local.deregister_event_handler(@ips_eh)
end

#desc ⇒ Object 



45
46
47
 
# File 'plugins/ips_filter.rb', line 45

def desc
  'Scans all outgoing data to see if it matches a known IPS signature'
end

#name ⇒ Object 



41
42
43
 
# File 'plugins/ips_filter.rb', line 41

def name
  'ips_filter'
end