nerdexam
GIAC

GCIA · Question #4

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack

The correct answer is A. Nessus C. Whisker. Session splicing splits TCP attack data across many small packets to defeat IDS signature matching; Whisker and Nessus each include built-in capabilities to perform this evasion technique.

Threat Hunting & Timeline Analysis

Question

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple smallsized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ANessus
  • BY.A.T.
  • CWhisker
  • DFragroute

How the community answered

(24 responses)
  • A
    75% (18)
  • B
    8% (2)
  • D
    17% (4)

Why each option

Session splicing splits TCP attack data across many small packets to defeat IDS signature matching; Whisker and Nessus each include built-in capabilities to perform this evasion technique.

ANessusCorrect

Nessus includes scan configuration options that fragment probe data across small TCP segments, allowing it to perform session splicing as part of IDS-evasion scanning during vulnerability assessments.

BY.A.T.

Y.A.T. is not an established or recognized tool for performing TCP-level session splicing or IDS evasion attacks.

CWhiskerCorrect

Whisker is a web application scanner explicitly designed with IDS evasion modes, including session splicing, where it splits HTTP request data across multiple small TCP segments to prevent pattern-matching IDS engines from reassembling and recognizing attack signatures.

DFragroute

Fragroute operates at the IP layer to fragment datagrams, which constitutes IP fragmentation evasion - a distinct technique from TCP-layer session splicing.

Concept tested: Session splicing IDS evasion tools identification

Source: https://owasp.org/www-community/attacks/Session_Splicing

Topics

#session splicing#IDS evasion#packet fragmentation#network evasion

Community Discussion

No community discussion yet for this question.

Full GCIA Practice