312-50 Question 268
Select 2▪ Evading FirewallsDuring an authorized internal security assessment, you discover that a perimeter firewall blocks direct inbound connections to most ports from your test host, but the organization permits outbound web traffic from internal systems through an HTTP/HTTPS proxy. You need to demonstrate whether a covert command-and-control style channel could blend with allowed traffic without relying on obviously blocked ports. Which TWO techniques would be the most appropriate to test firewall evasion in this scenario?
- A
Configure a reverse HTTPS beacon or tunnel over TCP 443 so the callback uses encrypted outbound traffic that resembles normal web sessions
- B
Send a TCP SYN flood against the firewall to force it into a fail-open state and then connect directly to the target service
- C
Use an HTTP CONNECT-capable proxy tunnel to relay traffic through the organization's approved web proxy
- D
Switch to Telnet on TCP 23 because legacy protocols are less likely to be inspected by modern firewalls
- E
Use fragmented IP packets as the primary technique to bypass the firewall, assuming most enterprise firewalls do not perform reassembly or normalization
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are the techniques that exploit permitted egress paths rather than trying to break the firewall. In this scenario, outbound web traffic and proxy use are explicitly allowed, so the most realistic firewall-evasion tests are: (1) establishing a reverse HTTPS callback over TCP 443 and (2) tunneling through an approved HTTP CONNECT proxy. These align with real-world attacker tradecraft and with defensive guidance emphasizing egress filtering, proxy restrictions, TLS inspection where appropriate, and application-aware monitoring. By contrast, denial-of-service is not an evasion technique, Telnet does not fit the allowed traffic pattern, and IP fragmentation is far less reliable against modern firewalls that perform stateful inspection and normalization. References consistent with this reasoning include common enterprise firewall best practices from vendors such as Palo Alto Networks, Cisco, and Fortinet regarding egress control and proxy-aware inspection, as well as general guidance in NIST network security architecture publications on controlling outbound communications and monitoring approved channels.
- A. Correct.
Correct. In environments where outbound HTTPS is allowed, a reverse connection over TCP 443 is a realistic firewall-evading approach because it avoids relying on inbound access and can blend with permitted encrypted web traffic. In a CEH context, this reflects a common technique for testing whether egress filtering is too permissive. The key point is the outbound callback over an allowed port and protocol, not merely using port 443 by itself.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service attack, not a valid or controlled firewall evasion method for demonstrating covert channel risk during an ethical assessment. It is disruptive, may violate rules of engagement, and enterprise firewalls are not expected to fail open under such conditions. This option reflects the misconception that causing instability is an acceptable path to bypass controls.
- C. Correct.
Correct. If the environment uses an approved web proxy and permits HTTP CONNECT, tunneling traffic through that proxy is a practical way to test whether restricted traffic can be relayed over sanctioned egress paths. This is a realistic evasion technique because many organizations intentionally allow proxy-mediated outbound traffic while blocking direct connections. The candidate must recognize that using the approved proxy path is often more effective than attempting direct outbound connections.
- D. Incorrect.
Incorrect. Telnet over TCP 23 is typically blocked rather than favored, and it does not blend with normal web traffic. It is also plaintext, making it easier to inspect and less suitable for stealth or secure tunneling. This distractor targets the misconception that older protocols are somehow overlooked by firewalls simply because they are legacy services.
- E. Incorrect.
Incorrect. Fragmentation has historically been used in some evasion attempts, but modern stateful firewalls, IDS/IPS platforms, and secure gateways commonly perform packet reassembly, normalization, or drop suspicious fragments. Using fragmentation as the primary assumption-based strategy is unreliable in current enterprise environments. It may be worth limited testing in some assessments, but it is not the most appropriate choice in a scenario centered on allowed outbound web/proxy traffic.