Objectives
The simulator ticks each one as soon as the network meets it.
- On LAP1, send ordinary JavaScript and the Shellshock probe. Both arrive: traffic tcp 203.0.113.10 80 payload "POST /notes text=function() { return 1; }", then traffic tcp 203.0.113.10 80 payload "GET /cgi-bin/status User-Agent: () { :; }; /bin/bash -c id".
- On the Intrusion screen, add the rule with two contents: drop tcp any any -> any 80 (msg:"Shellshock in a request header"; content:"() {"; content:"/bin/"; sid:1000060; rev:1;)
- Create IPS policy SHELL-IPS (base connectivity, mode prevention), set rule 1000060 to drop in it, and attach it to HTTP-WEB, the inbound rule.
- Deploy. Shellshock is dropped by rule 1000060, and the JavaScript note still arrives.