nerdexam
GIAC

GCIA · Question #21

John works as a professional Ethical Hacker. He has been assigned the project of testing the that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the…

The correct answer is C. Mendax. Mendax is a specialized tool used to perform IDS evasion by crafting overlapping packet fragments, causing the IDS to process different data than the target host reassembles.

Advanced Snort Rule Writing & Signature Evasion

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data. Which of the following tools can he use to accomplish the task?

Options

  • AHunt
  • BAlchemy Remote Executor
  • CMendax
  • DEttercap

How the community answered

(29 responses)
  • A
    14% (4)
  • B
    3% (1)
  • C
    76% (22)
  • D
    7% (2)

Why each option

Mendax is a specialized tool used to perform IDS evasion by crafting overlapping packet fragments, causing the IDS to process different data than the target host reassembles.

AHunt

Hunt is a TCP session hijacking and monitoring tool, not designed for crafting overlapping packet fragments or IDS evasion.

BAlchemy Remote Executor

Alchemy Remote Executor is a remote administration and command execution utility, entirely unrelated to packet fragmentation or IDS evasion.

CMendaxCorrect

Mendax is purpose-built for IDS evasion using techniques such as fragment overlap, where a packet fragment contains data that overlaps with a previous fragment. This causes the IDS and the target host to reassemble the byte stream differently, allowing malicious payloads to slip past signature detection. It is the tool specifically designed for the fragment overlap IDS evasion scenario described in the question.

DEttercap

Ettercap is a man-in-the-middle attack framework used for network sniffing and ARP poisoning, not for crafting overlapping fragments to evade IDS.

Concept tested: IDS evasion via packet fragment overlap tool

Topics

#fragment overlap#IDS evasion#Mendax#packet fragmentation

Community Discussion

No community discussion yet for this question.

Full GCIA Practice