312-50V11 · Question #39
You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the…
The correct answer is C. IP Fragment Scanning. IP Fragment Scanning splits the TCP header across multiple small IP fragments, making it difficult for packet filters and intrusion detection systems to determine the purpose of the scan.
Question
You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the packets are meant for. Which of the below scanning technique will you use?
Options
- AACK flag scanning
- BTCP Scanning
- CIP Fragment Scanning
- DInverse TCP flag scanning
How the community answered
(65 responses)- A6% (4)
- B3% (2)
- C89% (58)
- D2% (1)
Why each option
IP Fragment Scanning splits the TCP header across multiple small IP fragments, making it difficult for packet filters and intrusion detection systems to determine the purpose of the scan.
ACK flag scanning sends packets with only the ACK flag set to probe firewall rule sets and distinguish stateful from stateless filters, not to fragment packets for evasion.
TCP Scanning is a broad category covering many connection-based scan types and does not describe a specific packet-fragmentation evasion technique.
IP Fragment Scanning works by dividing the TCP header into multiple fragmented packets so that many firewalls and IDS engines, which do not reassemble fragments before inspection, cannot analyze the complete packet and identify the scan. This fragmentation effectively obscures the nature of the probe from security controls sitting on the network path. It is a recognized evasion technique used specifically when a penetration tester needs to avoid triggering signature-based detection.
Inverse TCP flag scanning uses abnormal flag combinations such as FIN, URG, or PSH to elicit RST responses from closed ports on some operating systems, which is unrelated to IP fragmentation.
Concept tested: IP packet fragmentation for IDS and firewall evasion
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.