GCIA: GIAC Certified Intrusion AnalystDemo

Question

Session splicing is an IDS-evasion technique in which an attacker sends data to the target computer in multiple small-sized packets. As a result, it becomes very difficult for an IDS to detect the attack signatures of these attacks. Which of the following tools can be used to perform session-splicing attacks?

Each correct answer represents a complete solution. Choose all that apply.

Choose two

A Nessus
B Y.A.T.
C Whisker
D Fragroute

Explanation

Whisker supports session splicing by sending an attack request in very small portions so a signature may not occur in any individual packet. Legacy Nessus also included IDS-evasion testing that could apply session-splicing-style traffic to its checks. Fragroute is chiefly used for packet fragmentation and manipulation, which is distinct from session splicing.

GCIA: GIAC Certified Intrusion AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ489

Community Discussion