Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks? Each correct answer represents a complete solution. Choose all that apply.

Question

Accepted Answer

A. Nessus Nessus includes scan configuration options that fragment probe data across small TCP segments, allowing it to perform session splicing as part of IDS-evasion scanning during vulnerability assessments. C. Whisker Whisker is a web application scanner explicitly designed with IDS evasion modes, including session splicing, where it splits HTTP request data across multiple small TCP segments to prevent pattern-matching IDS engines from reassembling and recognizing attack signatures.

Answer

B. Y.A.T. Y.A.T. is not an established or recognized tool for performing TCP-level session splicing or IDS evasion attacks.

Answer

D. Fragroute Fragroute operates at the IP layer to fragment datagrams, which constitutes IP fragmentation evasion - a distinct technique from TCP-layer session splicing.

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack

Question

Options

How the community answered

Why each option

Topics

Community Discussion