312-50V10 · Question #779
Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signat
The correct answer is D. Whisker. Whisker is the tool that pioneered session splicing as an IDS evasion technique, fragmenting HTTP requests into small packets to prevent IDS signature matching.
Question
Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?
Options
- Atcpsplice
- BBurp
- CHydra
- DWhisker
How the community answered
(26 responses)- A8% (2)
- B4% (1)
- D88% (23)
Why each option
Whisker is the tool that pioneered session splicing as an IDS evasion technique, fragmenting HTTP requests into small packets to prevent IDS signature matching.
tcpsplice (or tcpslice) is a utility for extracting and merging pcap capture files, not a tool for performing session splicing attacks against IDS systems.
Burp Suite is a web application security testing proxy used for intercepting and manipulating HTTP/S traffic between a browser and server, and does not perform session splicing IDS evasion.
Hydra is an online password brute-forcing tool that supports numerous protocols, and has no functionality related to TCP session fragmentation or IDS evasion techniques.
Whisker, written by Rain Forest Puppy, was one of the first CGI scanners to implement session splicing and other IDS evasion techniques by splitting attack payloads across multiple small TCP segments. Because many IDS systems reassemble packets inefficiently or only inspect individual packets rather than the full reassembled stream, the fragmented payload bypasses signature detection. Whisker's evasion module directly implements the session splicing method described in the question.
Concept tested: Session splicing IDS evasion using Whisker
Source: https://owasp.org/www-community/attacks/Session_Splicing
Topics
Community Discussion
No community discussion yet for this question.