ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ38

Network Penetration Testing Methodology – External

Peter is a lead penetration tester at a security services firm called Xsecurity. He has recently been assigned a white-box penetration test to assess the security of an IDS deployed by a client. During initial information gathering, Peter determined that the TTL needed to reach the IDS from his location is 30.

Peter created a Trojan and split it into one-character packets with the Colasoft packet builder tool. He then used a packet-flooding utility to bombard the IDS with these fragmented packets, addressed to a target host behind the IDS with a TTL of 35.

What is Peter attempting to accomplish?

  • A Peter is trying to bypass the IDS system using a Trojan
  • B Peter is trying to bypass the IDS system using the broadcast address
  • C Peter is trying to bypass the IDS system using the insertion attack
  • D Peter is trying to bypass the IDS system using inconsistent packets
Explanation

An insertion attack exploits a difference between the traffic interpretation available to an IDS and the traffic that reaches or is interpreted by the protected endpoint. TTL-based packet handling and fragmentation can desynchronize the IDS’s reconstructed stream from the destination host’s stream, allowing an attacker to insert misleading fragments into the IDS’s view and conceal malicious traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!