GCIA · Question #21
John works as a professional Ethical Hacker. He has been assigned the project of testing the that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the…
The correct answer is C. Mendax. Mendax is a specialized tool used to perform IDS evasion by crafting overlapping packet fragments, causing the IDS to process different data than the target host reassembles.
Question
John works as a professional Ethical Hacker. He has been assigned the project of testing the that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data. Which of the following tools can he use to accomplish the task?
Options
- AHunt
- BAlchemy Remote Executor
- CMendax
- DEttercap
How the community answered
(29 responses)- A14% (4)
- B3% (1)
- C76% (22)
- D7% (2)
Why each option
Mendax is a specialized tool used to perform IDS evasion by crafting overlapping packet fragments, causing the IDS to process different data than the target host reassembles.
Hunt is a TCP session hijacking and monitoring tool, not designed for crafting overlapping packet fragments or IDS evasion.
Alchemy Remote Executor is a remote administration and command execution utility, entirely unrelated to packet fragmentation or IDS evasion.
Mendax is purpose-built for IDS evasion using techniques such as fragment overlap, where a packet fragment contains data that overlaps with a previous fragment. This causes the IDS and the target host to reassemble the byte stream differently, allowing malicious payloads to slip past signature detection. It is the tool specifically designed for the fragment overlap IDS evasion scenario described in the question.
Ettercap is a man-in-the-middle attack framework used for network sniffing and ARP poisoning, not for crafting overlapping fragments to evade IDS.
Concept tested: IDS evasion via packet fragment overlap tool
Topics
Community Discussion
No community discussion yet for this question.