GCIA: GIAC Certified Intrusion AnalystDemo

By GIAC · Question Mode

QuestionQ437

Fragmentation

John is a professional Ethical Hacker assigned to test the security of www.we-are-secure.com. He wants to send malicious data packets so that one packet fragment overlaps data from an earlier fragment, enabling IDS evasion on the We-are-secure server and execution of malicious data. Which of the following tools can he use to accomplish this task?

  • A Hunt
  • B Alchemy Remote Executor
  • C Mendax
  • D Ettercap
Explanation

Mendax is a TCP desynchronization tool that injects overlapping segments in random order, creating the reassembly discrepancy used for IDS evasion. Overlapping fragments can cause an inspection system and the destination host to reconstruct traffic differently, allowing malicious content to evade inspection.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!