Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 2 — Questions and Answers
Question 1: Which IDS evasion technique involves breaking a single exploit into multiple small packets that individually appear harmless?
- Obfuscation
- Session Splicing (Correct answer)
- Protocol Anomaly
- TTL Manipulation
Correct answer: Session Splicing
Session splicing fragments an attack payload across multiple TCP segments so that the IDS does not reconstruct the full attack signature.
Question 2: What is the purpose of using Unicode or hex encoding in IDS evasion?
- To compress attack payloads for faster delivery
- To obscure attack strings so signature-based IDS does not detect them (Correct answer)
- To bypass SSL inspection
- To prevent logging of the attack
Correct answer: To obscure attack strings so signature-based IDS does not detect them
Encoding attack strings in Unicode or hex can bypass signature-based IDS that only match ASCII patterns, while the target server decodes and executes the payload normally.
Question 3: Which firewall evasion technique uses a series of intermediate hosts to hide the true source of an attack?
- Fragmentation
- Source Routing
- Proxy Chaining (Correct answer)
- Tunneling
Correct answer: Proxy Chaining
Proxy chaining routes attack traffic through multiple proxy servers, masking the original source IP and making attribution difficult.
Question 4: What does a stateful firewall track that a stateless (packet-filtering) firewall does not?
- Source and destination IP addresses
- The state of active network connections (Correct answer)
- Layer 7 application data
- DNS query responses
Correct answer: The state of active network connections
A stateful firewall maintains a connection state table and tracks the full context of active sessions, allowing it to detect out-of-state packets that stateless firewalls miss.
Question 5: Which technique involves manipulating the TTL field of packets to confuse IDS reassembly while the target host still receives the attack?
- Fragmentation Overlap
- TTL Manipulation (Correct answer)
- Protocol Mutation
- Insertion Attack
Correct answer: TTL Manipulation
TTL manipulation sets different TTL values so that some decoy packets expire before reaching the IDS but the actual attack payload reaches the target.
Question 6: What type of IDS evasion injects extra packets into a stream that the IDS accepts but the target host rejects, causing the IDS to build a different view of the session?
- Evasion Attack
- Insertion Attack (Correct answer)
- Fragmentation Attack
- Obfuscation Attack
Correct answer: Insertion Attack
An insertion attack sends packets with invalid checksums or TTLs that the IDS accepts but the end host drops, causing the IDS to reconstruct a different data stream.
Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 2
Which IDS evasion technique involves breaking a single exploit into multiple small packets that individually appear harmless?