Skip to content

Techniques for Evading IDS

  1. Traffic Obfuscation:
  2. Encryption: Encrypting traffic can prevent IDS from inspecting the payload. For example, using tools like Stunnel or OpenVPN to encrypt data streams.

  3. Encoding: Encoding payloads in formats like Base64 or using URL encoding can obscure the content. For example, encoding an SQL injection payload to bypass detection filters.

  4. Fragmentation:

  5. Packet Fragmentation: Breaking malicious payloads into smaller packets can evade detection by causing IDS to miss reassembled payloads. Techniques like IP fragmentation or TCP segmentation can be used.

  6. Polymorphism and Metamorphism:

  7. Polymorphic Code: Altering the code structure without changing its functionality to evade signature-based detection. For example, changing variable names or code layout.

  8. Metamorphic Code: Completely rewriting the code to avoid signature detection. This involves transforming the code into a different form while maintaining the same behavior.

  9. Protocol Manipulation:

  10. Protocol Tunneling: Encapsulating malicious traffic within legitimate protocols. For instance, using HTTP or DNS tunneling to bypass IDS inspection.
  11. Protocol Abuses: Exploiting protocol features to hide malicious payloads. For example, using malformed packets or unusual protocol behaviors.

Techniques for Evading Firewalls

  1. Port Knocking:

  2. Description: A technique where an attacker sends a sequence of connection attempts to closed ports. If the correct sequence is detected, the firewall temporarily opens a port for the attacker.

  3. IP Spoofing:

  4. Description: Forging the source IP address to make traffic appear as if it comes from a trusted source. This can bypass IP-based filtering rules in firewalls.

  5. Tunneling:

  6. Description: Encapsulating malicious traffic within a legitimate protocol or using VPNs to bypass firewall rules. Techniques like SSH tunneling or VPNs can obscure the real nature of the traffic.

  7. Use of Allowed Ports:

  8. Description: Exploiting commonly allowed ports (e.g., HTTP on port 80) to deliver malicious payloads. This involves disguising the payload as legitimate traffic to bypass firewall filtering.