312-50V10 · Question #39
You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the…
The correct answer is C. IP Fragment Scanning. IP Fragment Scanning splits TCP headers across multiple IP fragments, making it harder for firewalls and IDS systems to reassemble and inspect the scan intent.
Question
You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the packets are meant for. Which of the below scanning technique will you use?
Options
- AACK flag scanning
- BTCP Scanning
- CIP Fragment Scanning
- DInverse TCP flag scanning
How the community answered
(44 responses)- A2% (1)
- B2% (1)
- C93% (41)
- D2% (1)
Why each option
IP Fragment Scanning splits TCP headers across multiple IP fragments, making it harder for firewalls and IDS systems to reassemble and inspect the scan intent.
ACK flag scanning sends packets with only the ACK flag set to map firewall rules and determine stateful vs stateless filtering, not to evade detection via packet fragmentation.
TCP Scanning is a broad term for standard TCP-based connection scans such as SYN or full connect scans and does not involve splitting headers into fragments.
IP Fragment Scanning divides the TCP header into multiple small IP fragments. Since packet filters and IDS systems often cannot reassemble these fragments in real time, they fail to identify the scan type or block it, allowing the scan to evade detection while still reaching the target.
Inverse TCP flag scanning uses unusual flag combinations such as FIN, URG, or PSH to elicit RST responses from closed ports, which is a different evasion technique unrelated to IP fragmentation.
Concept tested: IP fragmentation for IDS and firewall evasion
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.