nerdexam
EC-Council

312-50V10 · Question #779

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signat

The correct answer is D. Whisker. Whisker is the tool that pioneered session splicing as an IDS evasion technique, fragmenting HTTP requests into small packets to prevent IDS signature matching.

Evading IDS, Firewalls, and Honeypots

Question

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?

Options

  • Atcpsplice
  • BBurp
  • CHydra
  • DWhisker

How the community answered

(26 responses)
  • A
    8% (2)
  • B
    4% (1)
  • D
    88% (23)

Why each option

Whisker is the tool that pioneered session splicing as an IDS evasion technique, fragmenting HTTP requests into small packets to prevent IDS signature matching.

Atcpsplice

tcpsplice (or tcpslice) is a utility for extracting and merging pcap capture files, not a tool for performing session splicing attacks against IDS systems.

BBurp

Burp Suite is a web application security testing proxy used for intercepting and manipulating HTTP/S traffic between a browser and server, and does not perform session splicing IDS evasion.

CHydra

Hydra is an online password brute-forcing tool that supports numerous protocols, and has no functionality related to TCP session fragmentation or IDS evasion techniques.

DWhiskerCorrect

Whisker, written by Rain Forest Puppy, was one of the first CGI scanners to implement session splicing and other IDS evasion techniques by splitting attack payloads across multiple small TCP segments. Because many IDS systems reassemble packets inefficiently or only inspect individual packets rather than the full reassembled stream, the fragmented payload bypasses signature detection. Whisker's evasion module directly implements the session splicing method described in the question.

Concept tested: Session splicing IDS evasion using Whisker

Source: https://owasp.org/www-community/attacks/Session_Splicing

Topics

#session splicing#IDS evasion#Whisker#packet fragmentation

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice