Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 2

Question 1

Which IDS evasion technique involves breaking a single exploit into multiple small packets that individually appear harmless?

Accepted Answer

Session Splicing

Answer

Session splicing fragments an attack payload across multiple TCP segments so that the IDS does not reconstruct the full attack signature.

Question 2

What is the purpose of using Unicode or hex encoding in IDS evasion?

Accepted Answer

To obscure attack strings so signature-based IDS does not detect them

Answer

Encoding attack strings in Unicode or hex can bypass signature-based IDS that only match ASCII patterns, while the target server decodes and executes the payload normally.

Question 3

Which firewall evasion technique uses a series of intermediate hosts to hide the true source of an attack?

Accepted Answer

Proxy Chaining

Answer

Proxy chaining routes attack traffic through multiple proxy servers, masking the original source IP and making attribution difficult.

Question 4

What does a stateful firewall track that a stateless (packet-filtering) firewall does not?

Accepted Answer

The state of active network connections

Answer

A stateful firewall maintains a connection state table and tracks the full context of active sessions, allowing it to detect out-of-state packets that stateless firewalls miss.

Question 5

Which technique involves manipulating the TTL field of packets to confuse IDS reassembly while the target host still receives the attack?

Accepted Answer

TTL Manipulation

Answer

TTL manipulation sets different TTL values so that some decoy packets expire before reaching the IDS but the actual attack payload reaches the target.

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 2