I
now all right there we go cool deal all
right so I want to talk about filters
we're going to take a look at some of
the shortcomings of filters and
shortcomings of signature development
we're going to talk about evasions
mainly we're going to talk about
examining some relevant evasion
techniques we're going to focus on web
attacks and I'm going to start out
talking about some some older evasion
techniques and then towards the end talk
about a way to bypass snort so what are
some reasons to aveda filter money one
of the probably number one reason people
do anything right I guess a short second
would be fun probably another good
reason to do things yeah I mean so you
have spammers that are trying to evade
spam filters you have you know lonely
people trying to evade porn filters
information of course you got truth
seekers like people behind the Great
Firewall of China people behind I guess
now the great firewall of Australia did
you guys hear about that they're pretty
much doing the same thing as China and
filtering high speeds in Australia are
filtering content I need legal act of
course maybe you want to steal some
private data or steal money or steal
porn or steal information so security
filters responsibility of security
filters just to detect actions that temp
to compromise a resource typically they
react by either allowing an attempt
denying an attempt logging it or just
removing it from a network stream
entirely security filters are usually
black box to people that purchase them
or maybe even they set up an open source
one but they really don't understand how
it works it's just something they
they've hooked into their network or
they've installed on their web server
and they really don't necessarily
understand what how it works under the
covers might not understand some of the
shortcomings or or ways that it can be
evaded and they typically use signatures
which are blacklist sure you guys know
that the dangers of blacklist
so why is it important under vent
understand evasion tactics because cyber
criminals are using them that's you know
for us security professionals that's the
number one reason if you're a
penetration tester you need to know what
the cyber criminals are doing so you can
emulate them and hopefully you know a
few techniques they don't so that you're
one step ahead of them for developers
especially developers of filters they
need to know how to you know make mega
filters as best as possible and reduce
the ways that they can be evaded and
then the people that are tests that are
testing the filters they need to know
how to do that properly I'm web filters
are everywhere I mean you have HTTP
inspect preprocessor and snort you have
web application firewalls like mod
securities is probably the most
notorious example you have things that
install into your server like you are
else can you have things baked into your
development frameworks like asp.net XSS
filter which is baked in it's called out
it's for request validation you have
things baked into the browser now with
upcoming release of IE 8 and I mean
there's been discussion on how to evade
that already and even though it's not
even out officially it's still in RC one
or two I think and then of course I mean
you I'm sure you guys in here have
written some code you've probably
written a filter so everywhere and
there's even new filters just last year
in October the Department of Homeland
Security said that they're investing in
developing new IDs and IPS and you know
will they will they learn how to do it
properly will they learn from others
mistakes I guess time will tell
hopefully they'll do some research and
maybe a look at this presentation even
and so we have filters across the entire
OSI model we have you know maybe not so
much at the physical layer that's you
know physical security or whatever but
we have in the segment portion of the
model we have at the transport layer we
have things like IDs and then above that
we have things up you know in the
application layer protecting data and so
the question I want you to think about
is who's responsible for all these
layers because as I'm going to
demonstrate as I go through some old
attacks
attackers are consistently moving up the
stack your networks perimeter is
becoming more and more safe and your
applications are more exposed than ever
especially web applications and so you
know when we when we ask who's
responsible its security professionals
like us we need to be educated it's you
know if it's the open source community
developing these filters they need to be
education selling proprietary products
they all need to they're responsible for
making these as best as possible and the
problem that I'm seeing is that proper
knowledge transfer isn't occurring
because I'm seeing the same thing over
and over again and so I want to like
back up a little bit and if you guys
read the website that i posted a little
bit of background in and how this all
kind of started how I got interested in
this topic was we were doing a pen test
at work on a fortune I guess the
probably like fortune 15 company will
just say their favorite color truck to
drive is brown and they had basically
challenged us to break in they basically
said you know why do I need to protect
my my web applications I have all these
network appliances that protect my my
site and you know prove to me that I
need to protect my web applications yeah
yeah that's what the CIO basically of
this company said or sepia or something
along those lines he um he wanted us to
prove him prove prove him that he needed
to look into this more and what happened
was I got caught right noob all right so
I i was running dirt Buster on a bunch
of their URLs and I'm glad I did because
after I got caught I got blocked i guess
was causing way too much noise and i
just moved to another IP address and
continued running dirt Buster and I
found this I guess dirt Buster in its
default list had ups as one of their I
guess I said it they had that is
one of their directories and whenever we
made a request to that their cash on
delivery their c.o.d site it redirected
to an admin pay admin directory from the
UPS directory which I thought was really
strange
and then that admin login happened to
have blind sequel injection in it and a
co-worker of mine modified our sequin
jected tool would work on with with
Oracle which was running in the back end
and we started downloading images of
checks from customers with account
numbers on them and it's like wow this
is really bad so I mean this this got me
interested in you know that that I was
blocked and and but I you know still
found this great hack and and then we
moved on and Billy actually sent out an
email to all of our R&D and he asked us
to or he asked anyone that was willing
to do it to implement some old evasion
tactics that Jeff forced or reinforced
puppy or fee guys might have read his
paper from 1999 on anti IDs tactics and
so the only one of these implemented
into our proxy so that we could actually
just take real-time web traffic and turn
on these of asians and the proxy would
modify them on the fly and it was like I
decided to look into this because I
wanted to learn how not to get caught
and basically uh it was really easy you
know we just did some searching for
places and things were going across the
wire and and so that that's really what
I wanted to to say like when I this this
all was based on some stuff that's been
done previously and as I researched into
these older techniques you know thanks
to Jeff worstall for his work and thanks
to you know Billy for even putting that
out there or I probably wouldn't be up
here talking today so these are his
tactics this is 1999 and what he's doing
is he has a method matching technique or
Mike knows verb tampering changing
things like get to head he's doing
things like URL encoding just simple hex
notation for ASCII text doing things
like double slashes so servers will
actually I assume it was a usability
thing so maybe a web browser fat
fingered in double type two slashes and
the server just replaces it with one and
accepts it well your filter also needs
to realize if it's just looking for one
slash that too is also acceptable bus
servers reversed reversal things such as
putting a fake directory in and stepping
out of it if they're looking for things
like traversal into admitting
self-referencing directories where you
can just do dot slash dot slash slash
and evade signatures that are only
looking for requests to secure
directories prematurely request ending
this is actually having multiple HTTP
versions and new lines in a request and
this one doesn't really work so so much
anymore um so I didn't even implement
that when I implemented these into a
proxy things like parameter hidings such
as unencoded certain parts of an encoded
URL so that a filter that if it thinks
everything's encoded and is trying to
normalize that it'll maybe miss
something whitespace miss formatting
things like changing space to tab so
that the HTTP RFC says you need to have
your verb and then space and then your
URL that you're requesting and then
space and then HTTP version well most
servers also accept tab things like
really long URLs where you might have a
filter maybe this isn't so much of an
issue in nowadays that you know what we
have a lot more computing power and a
lot more resources but in 1999 filters
were maybe only parsing the first two
megabytes of a request so just put a
bunch of random text there and then you
can have your payload for your attack
after that because it stopped after I
hit two megabytes you have things like
on Windows servers where you it'll
actually accept a backslash instead of a
/url it'll the server will just convert
it because again I'm sure it's a
usability thing things like null byte
processing where if it's a see library
that just hits a null byte and stops in
the filter you might miss the payload
after that and of course things like
case sensitivity where a signature is
really poorly written and it didn't
check for multiple cases or mixed case
and you can check out more details on
these filters at this URL so what Jeff
Forster really gave us was a playbook of
how to attack filters across the OSI
model we have things like an
optimization attacks or and encoding
method tampering you know basically what
I just pointed out
so canalization it's the process of
converting data to its simplest form so
when I mention normal normalization
before this is something that all
filters absolutely need to do very well
they need to be able to take all the
different representations of data and be
able to simplify it so that that they
can then perform their analysis and and
not miss things um this isn't so much an
evasion and it's it's sort of a
vulnerability but basically this one's
near and dear to my heart because I was
working as a asp.net developer in 2005
which is what when this vulnerabilities
from and it just blew my mind that this
was something that was overlooked in
testing of the framework so basically
what you do is send a backslash instead
of a forward slash in a URL and pull
down source code you could pull down web
config files and in Mozilla you could do
a backslash but IE would automatically
convert it for you see hex encoded 2% 5c
and like you know this is you know I was
developer and you know had an interest
in security and this just blew my mind
that this was missed whereas if they
would have you know tested something
like rfps techniques where he actually
had something that switched / it back
for such as the backslash slashes they
might have seen this happen um so poison
Mel bite attack was another as very
infamous one it's this is still
happening all the time I think just in
silverlight there was a bomb found in
the when i when it was still in beta
with a null byte but the one this one it
actually happened in 2007 and
modsecurity was vulnerable to this and
you could bypass any you can send any
post request and bypass their analysis
if it was an ascii z encoded text and
what a skeezy is is it's a seat based on
see and when you're assigning string
data the assignment will stop if it hits
an embedded null byte so what that would
look like is if the assignment to this
string is a b c plus and i'll bite orkin
cat no bike and cat one two three the
strings value would actually just be ABC
because it would stop and then the
assignment and so what modsecurity was
doing was it was used it was using this
and you could send an attack such as
this you could have this content type
and a post data that starts with an
unencoded null byte and send whatever
attack you wanted and their their
analysis didn't even see it another one
full width and half with Unicode this
was huge this hit Cisco tipping point
McAfee novell of information security
systems checkpoint all there HTTP
scanners could not handle full width or
half with an encoded strings and this
this was just an evasion I mean this
there's really what was no attack
involved with this but you could sneak
any attack by there are scanners with
this and so what what a full with
encoded string looks like our full with
? looks like is ufff or F F one F and
how you would you could write some PHP
code that would look like this and
actually you have to have the right
content type and then the output for
full width would look like you f-f-for
one and see script and half with looks
like efb see so that was a pretty huge
one that they were missing this encoding
so method tampering this there's paper
just in june two thousand eight from our
sean from aspect security their director
of research he pointed out that these
major frameworks and servers were
vulnerable to this method tampering
technique to let you bypass
authorization I mean these are major
players we had a patchy Tomcat security
it basically what how what this let you
do was for get functionality that's not
in the potent or like if you're familiar
with cross-site request forgery attacks
its you get supposed to not alter any
data whenever you make a get request to
a server it's supposed to give you the
same data back every time but if it's
altering something you can have huge
problems like I think the most
the most famous non-security example of
this was on google had the google web
accelerator plugin for firefox at any of
you ever tried that what it did was it
would go and get all the links on a page
and it would preemptively download them
before or go to them before you did in
anticipation that it that you might go
to them so it cash them and see maybe
your web browsing seemed faster but if
web developers didn't treat get as
Indian potent method which it's supposed
to be you know you have really been a
ste things happen you have data being
changed by google web accelerator when
you didn't mean to click a link and you
know another thing that that was pointed
out in this paper was uh that if you
didn't have your verb list configure
quickly it could accept arbitrary
methods such I could send like Rob
instead of get and it would act as a kit
which I thought was incredible yeah so
basically the RFC for HTTP says that
head is to be treated identical to get
except that the server must not return
message body in the response and so a
get request to admit directory that
that's supposed to require some type of
user in an admin role might you might
expect the head put and delete would be
denied right well what was pointed out
in those those web frameworks in the
service if you didn't explicitly deny
them in your configuration then they
were allowed and they were not treated
if you were just saying that get
requests needed to be off correctly but
you didn't say head needed to be off
correctly it would just go through and
if maybe made a request to something
like delete user that action would be
performed even though you're not off
properly so that's that was a really big
deal um so I mentioned you know you have
filters built into your frameworks such
as if you bust out reflector and
disassemble system.web of the.net
framework you hot you'll find this
cross-site scripting validation class
and in there is this is dangerous string
function and what this does is
it checks for a person pound it's
looking for you know basically encoded
strings it's looking for tags fault but
it's kind of limited here where it has a
tag and then it expects alphanumeric
characters immediately after the less
than sign and then it expects to have
either /or exclamation or ? and it also
skips strings that start with two
underscores because there are reserved
hidden fields in asp.net like view state
that might have encoded data that it
doesn't want to flag as cross-site
scripting and you can bypass this filter
with a string like this you know you're
using basically CSS style element and
you can pass in whatever attack you want
another encoding attack this was just in
August of last year we were actually in
the middle of the pen test that I
mentioned previously whenever I saw this
and I was like really Tomcat you're
still suffering from this directory
traversal in your latest release and
tested a bunch of servers but I'm kind
of ran out of time and so basically this
is if you have a special configuration
where you're allowing utf-8 encoding or
allow linking which is apparently not
that uncommon if you're an international
site you could encode the dot as % c 0 %
AE and you can directory traversal and
steal arbitrary files off the system so
i'm sure a lot of you are familiar with
our snakes XSS cheat sheet let's take a
look at some of the familiar things
we're seeing here we're seeing now bites
we're seeing case insensitivity white
space and you know there's another white
space where you bake a new line in there
to trip up filters you know this this
all goes back to properly understanding
and coding and the RFC for URL states
that you can only have alphanumeric and
a few special characters you're not even
lot to have spaces you're only allowed
to have percent 20 or plus and I've seen
web servers crash like from sending an
unencoded space to it so our arsenic's
chichi contains 70 unique ways to encode
the lesson son or the opening opening
tag yeah so I'm sure a lot of you are
probably familiar with the first four
but five through 70 maybe not so much
maybe you don't think about about those
a lot and there's even some missing
krameria doesn't have the full width or
half with encoding I mean there's so
many different ways to encode data and
it's really hard for filter developers
to grasp this um so the moral of story
is we're still partying like it's 1999
we still have you know method matching
or verb tampering issues we still have
encoding issues case sensitivity
whitespace you know these these are
still happening and that's that that's
the point I wanted to make and we're
still seeing these in big worms just the
ASP rocks are much like there was a talk
of that mentioned that earlier right so
you still see them using a cast which
lets you convert from between data types
in TC equal and there you know decoding
this hex and ascii string and putting
null bytes in there too perhaps the bait
things that are trying to parse it or
people that are researching malware and
maybe they don't maybe their vm that
they're running it through will miss it
because they didn't they using some c
library that stops it in all bytes and
you know the other problem with this is
that regular expressions are hard how
many people you know could look at this
and explain in detail and concisely
about what this is doing and like MIT
less than a minute probably can't do it
you do it cool you should write filters
um how many you're familiar with
backtracking when writing regular
expressions yeah yeah aka infinite regex
or runs indefinitely yeah so did I I
actually was working on a static
analysis product and we were we had a
regex that just parse the HTML tags out
of out of a web page when it came across
it and actually didn't figure out the
problem till a bit for for this until I
got a bit a bit obsessed we were driving
up to
Freaknik a couple years ago and my buddy
was driving and I was sitting the
passion see with my laptop and I was
just removing things from this HTML file
to narrow down what the problem was and
so what what backtracking is is
basically if you written regex that
exponentially increases your CPU time
your Big O of n N squared and it's
caused whenever you write something that
can match a match and I'll explain what
I mean by that and another thing I
thought about is it potential that if a
signature was poorly written could you
denial service a filter with this yeah
probably um so like let's look at this
regex we have one or more character of X
1 or more character X 1 or more previous
two matches combined followed by the
single character y and reg ex is a great
tool if you don't know about it it
actually has backtrack detection in it
and it'll it'll see it'll run this and
i'll show you like okay i am basically
like running two loops because i have
something like this where i'm tracing
over the same thing over and over again
and i'm gonna have to start over to see
if the same if this is happening again
and it it just kills your system and
it'll just look like it's good hanging
and we know we ran into this because we
were we were looking for HTML tags and
we were looking for you know open tag
and then some alphanumeric and we didn't
really count on that in asp.net there
you can have hyphens in there's a lot of
properties that have hyphens in them and
when we encountered a page that's like
that followed by some a new line we
basically got into this loop of looking
for more opening and closing tags in and
around this hyphen instead just kept
racing over and over the same HTML tags
and those hanging are our program um so
I showed that regex from modsecurity
which is massive I hate hate regex is
like that because it's just it's too
complicated and I feel like something in
there is going to go wrong but I'm a big
fan of the PHP ID s regex is there
simple concise well documented a lot of
people are using them I'm actually using
the
it in the tool on developing which I'll
show you later on um but it even has
some problems so I mean there's yeah
they have to smoke test website where
you can put in and it's an attack and
it'll tell you if anything flag so
there's a simple cross-site scripting
attack but what it detected classic
sequel injection probing just because I
had some tick marks in there like that's
that's a bit overkill in my opinion I
really hate false positives but it's
it's difficult you know white lists are
good but how many developers and QA
engineers really understand the subset
of strings that the regex that their
products using will match or miss not
many what about signature writers even
more importantly it's really difficult
to find the balance between false
positives and false negatives and even
your even if you did everything else
right your underlying signature engine
can have problems such as pcre which is
what snort uses it it's had a lot of
serious vulnerabilities maybe only like
memory corruption yeah if you're
interested you can go check out the CVS
so you know once again moral the story
is you know right now the biggest target
seems to be the application layer but
what about that that transport layer is
it is it safe even with all these these
uh network devices that we have yeah not
so much so one technique that I didn't
mention yet that was in that 1999 paper
from Jeff Forrestal and that's his tribe
tribal tatt right Billy said you say has
that on his arm okay cool it's it's
called session splicing and it's the
only network level attack in his paper
and it involves sending parts of the
requests in different packets how many
people have heard of this before anyone
okay we've got a few people cool so
basically if you have a request to root
directory just a simple gate request it
may might be split across multiple
packets like this so each one of these
would be you know I'm just sending this
little bit of data this
this a little bit it's not the same as
IP fragmentation when I was explaining
this a few my friends like oh you mean
like like fragmentation like no not
quite so IP fragmentation happens
whenever packets are too large and this
is something that can happen naturally
which is why these network appliances
need to handle this and basically
involves splitting between the router
will split between multiple packets
because it's too large and sessions
blessing is purposefully making it small
so that you're and you're sending it
across multiple packets to evade
detection so what's the defense that
audiences have against this they can for
fragmentation they reassemble packets
even though like I p at the IP level
it's supposed to be stateless and it's
supposed to be like fire packets and and
forget about them but you still if
fragmentation occurs you have to have a
sense of what's happening in the future
to and keep things around on the same
thing with session reassembly where
which happens at the TCP layer and you
have to be able to reassemble these
packets and another simple defense that
I like the best is if you think
something is is wrong if you think your
your filters being attacked by this just
sent a reset back it just kill the
connection I mean maybe you can't do
that if you're you've had to hide
dependencies for business software on
your network or something but um so I
was I was trying to do some session
splicing stuff against Google and they
were sending me reset packets and I
actually have a friend that works in
Zurich for Google and he asked him do
you know why this is happening he's like
yeah I'll pull up that code right now
and he's like well it's mainly for
performance reasons because we really
don't there's really no reason you
should have an open connection to our
search engines there's you know we can't
really afford that performance so we're
just gonna send a reset if you're
connected for longer than like 20
seconds or something
uh session splicing yeah yeah I'll show
you a little bit more problem so what's
the state of the evasion does whiskers
session splicing tactic still work on
snort know why is that because the
developers of snort read our fees paper
they they've said well he's pretty
famous hacker I'll you know put right
dry stuff to fix this and I'm I'll maybe
not really think about it anymore then
then I need to and I'll just you know
patch whatever heat hole he found um so
one really interesting piece about in
his paper about session splicing as he
says depending on your net your system
or network speed it'll send one to three
characters and so when I was trying to
code this tactic up into into the proxy
I i came across i came across this and
didn't really make sense to me until it
was implemented and it just wasn't
happening at all basically i wrote a
loop that was cutting these HTTP
requests up and sending them but my
system was so fast that it was going
through the loop so fast and putting
them all together and by the time it got
to my network adapter that was just
sending the whole request and that's
just probably the reason why um yeah and
i thought these up on wikipedia now I
was kind of losing it at intel's
marketing because it's like well you
think we need another ! but yeah and so
now i'm on my beast top here I have some
like extreme core2duo action happening
um so let's talk about how how I won't
follow through with this and bypassed
snort basically what I ended up doing
was a practical session splicing plus a
timing attack so because my system was
so fast and it was making it was putting
everything together before it could went
over the network I introduced a time
delay and the practical part about it is
I ended up basically taking the
signatures that I wanted to evade and
splitting the payload and and the reason
I did that was because at liner this
time delay and I you know kind of
thought what about like the session
reassembly timeout for snort if I if I
get up above that it's you know maybe
going to miss this stuff but if you
follow RF peas paper he says you know
just split everything like one or two
packets of time and then if I that had
to at that time delay we're looking at
like an hour and a half to send one HTTP
HTTP request which is not practical at
all so to make it more practical what we
ended or what what ended up doing was
taking the signature running the regex
on my payload and only splitting where I
needed to to evade the fill to evade the
signature and any IDs is vulnerable to
this if there's stateful inspection if
they're reassembly of a packets timeout
is less than the reassembly of the
server that's behind it and it's you
know this is similar to old
fragmentation attacks but it's moved up
one layer as I as I said attackers are
moving up though OSI stack and filter
developers need to be aware of this so
the code name for the to home writing is
called time splicer and i don't know if
that'll be the final name but i thought
that sounded cool so if we have an
attack such as this and just a very
simple signature is looking for a
normalized opening script tag or closing
script tag and we know that such the
stateful inspection time out for the
ideas which snorts is 30 seconds and we
can recursively go over our HTTP request
and split the attack string and make a
new packet and add time delay of you
know maybe 31 seconds between each
packet and yeah so as I said it's north
vulnerable to this because of their
default time now so whatever what the
request would end up looking like is the
first section and we stop after you know
the
opening tag and s and then wait you know
30 seconds or so and then send the
middle part of the attack and then you
know I'll wait to do is is wait another
30 seconds and send last party attack
and we have this sneak by a snort in a
little over a minute I'd say that's
practical especially if your cyber
criminal and you I'm sure you can wait
so what this looks like in wireshark is
you know we have our since an ack ack
and then the first part of the post we
get a hundred continue from the server
and then a knack i say i got your
continued and then you'll see a weight
and then you know send the next bit
which is right here you can see the data
right right there and then get another
100 continue and i sent another kin to
the rest of my packet and then I get my
200 ok I got my full response back and
hack and done and the default session
timeouts for you know Apache 10 minutes
I was seeing whenever I was sending this
attack talk to them I asked five point
over 15 minutes and newer is 20 minutes
you know so 30 seconds isn't really
going to cut it for your reassembly
inspection so what else can we do with
this information could fingerprint a
server based on its time out I can just
you know open this connection and send
send some data to it and let it hang and
then when i get a reset because it timed
out i know i might be able to tell what
server it is same with ids if the ids is
going to send me that reset or if it's i
might be able to tell what I'd yes
they're running on so many demo this for
you now
so I have a snort running and you can
see there's no traffic here and
so this is the prototype of my tool and
so there we go we're connected at
six-forty-five send the first part um
I'm so does this tool seem like
something you'd be interested in using
to your pen testers out there would you
if you you so I'm thinking of having
like an interactive console where you
can have any requests you want and you
can just paste them in and this this
will just fire off and run or have a you
can maybe load a file a little bunch of
requests and it'll just this will fire
off and run and I was going to bake in
the PHP ID s up so there's our response
coming back from the server yeah it's
pretty big the base page the UI first
snort web UI is pretty fat client here
we have 45 seconds and let's see it its
North detect it refresh this it's got
nothing let me just send an attack to
this page which is running on the snort
box see
expect you to
of course demo never goes right I
expected it to to flag this alert yep me
try something real quick
yeah just using the backtrack vm i had
on my machine to host snort which is
just a default install love me some
backtrack this is 34 doesn't have this
nice little service here to just one
click set it up yeah I know it's yeah
it's still in beta but uh I really like
that let's put a really insecure
password in there
yeah that's all fine just start the
service
cool
huh
well
I promise this works but um yeah so is
there any questions a card face point
I'm in there yeah yeah i'm i mean if you
want to be notified whenever this tool
is done and released just you can email
me or and i'll let you know as soon as
it's done or just pay attention to the
HP security blog and post up some
information on it when it's ready to
download on there so thanks I don't know
what the final name of it's going to be
because HP marketing might put the car
Bosh on time splicer but uh that's what
we're calling it now what's up
okay this one yeah
yeah it's wire trip net / RFP / txt /
whisker IDs HTML highly recommend going
to read that and also Newsham and Patek
have they did like the original IDs of
Asian presentation which in 98 that was
a big hit and should check that out that
talks more about like IP fragmentation
things like that and Robert grams done
some cool stuff with it dan kaminsky
black had a few years ago had some
interesting points about it as well he
was basically saying like that if your
time out of your IDs doesn't match the
time out of the reassembly on or on your
server that there you can even do some
other cool things like basically if the
time out of your IDs is greater than the
server's you can do some things to
bypass it like have it time out on the
server first and then the ids is still
holding it in place and then you start
sending new payload but the idea still
has the first part of the first payload
you sent so that it gets confused
because it has extra data in there and
then you end up still being able to
attack the server if the timeouts
greater than your then on your IDs than
it is on your server so they really need
to match up or do things like resets so
that's my recommendation you up do it