The official Nmap documentation provides extensive details on the technical parameters of network scanning for administrative purposes.
You’ve mastered the scan. You’ve found the open port. You fire off an exploit... and nothing happens. No shell. No banner. Just silence.
This makes the firewall’s log look like a riot, not a raid. You fire off an exploit
Obfuscation: This involves changing the appearance of the payload without altering its function. Using different encoding schemes (like Base64 or URL encoding) or inserting "junk" data can prevent the IDS from matching the attack against its signature database.Session Splicing: Similar to fragmentation, session splicing involves splitting the attack payload across multiple packets. If the IDS does not perform proper stream reassembly, it will fail to see the complete malicious string.Overlapping Fragments: By sending fragments that overlap in memory, an attacker can exploit differences in how the IDS and the target OS reassemble data. The IDS might see a harmless string, while the target OS executes the malicious one.Low and Slow Attacks: Instead of a rapid, noisy scan that triggers anomaly-based detection, ethical hackers might perform a "low and slow" scan, sending single packets at long intervals to stay below the detection threshold. Honeypots: Identifying the Trap
: Tunneling attack traffic through encrypted channels like SSH or DNS, which prevents the IDS from inspecting the payload. 2. Bypassing Firewalls No banner
A real server often has some misconfigurations, user history files, or patchy software. A honeypot might be "too clean" or perfectly configured. C. Probing for Virtualization Markers
Firewall evasion aims to pass traffic through to the target system despite strict access control policies. A. IP Address Spoofing user history files
By flooding the network or the IDS device with an overwhelming amount of junk traffic, the system's CPU and memory become exhausted. When an IDS drops packets due to resource constraints, malicious payloads can slip through uninspected. Spotting and Avoiding Honeypots