GCIH · Question #150
Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small- sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the…
The correct answer is A. Whisker C. Nessus. Session splicing fragments attack payloads into small packets to evade IDS signature matching, and Whisker and Nessus are tools that include this IDS evasion capability.
Question
Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small- sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks? Each correct answer represents a complete solution. Choose all that apply.
Options
- AWhisker
- BFragroute
- CNessus
- DY.A.T.
How the community answered
(40 responses)- A75% (30)
- B8% (3)
- D18% (7)
Why each option
Session splicing fragments attack payloads into small packets to evade IDS signature matching, and Whisker and Nessus are tools that include this IDS evasion capability.
Whisker is a web scanner explicitly designed with IDS evasion techniques, including session splicing, where HTTP request data is split across multiple small TCP segments so that no single packet contains a complete attack signature detectable by an IDS.
Fragroute operates primarily at the IP fragmentation layer to rewrite and fragment outgoing packets, and is not classified as a session splicing tool targeting application-layer session reassembly for IDS evasion.
Nessus is a vulnerability assessment platform that incorporates IDS evasion mechanisms in its scanning engine, including techniques that fragment session data across multiple small packets to test whether security controls can be bypassed.
Y.A.T. is not a recognized or documented tool in standard network security references as a tool used for performing session splicing attacks against intrusion detection systems.
Concept tested: Session splicing IDS evasion tools identification
Topics
Community Discussion
No community discussion yet for this question.