312-50 Question 274
Single answer▪ IDS/Firewall Evading ToolsDuring an authorized internal assessment, you discover that a perimeter IDS reliably alerts when you run a standard Nmap SYN scan against a DMZ web server. The engagement rules allow service discovery but prohibit denial-of-service conditions and prohibit using spoofed source addresses that would break return traffic. You want to reduce the chance of signature-based IDS detection while still receiving scan results from the target. Which Nmap approach is the most appropriate?
- A
Use a fragmented packet scan such as nmap -sS -f
- B
Use a spoofed decoy-only scan such as nmap -sS -D RND:10
without your real IP - C
Use an ACK scan such as nmap -sA
because ACK scans enumerate open TCP services more stealthily - D
Use a full connect scan such as nmap -sT
because completing the TCP handshake avoids IDS signatures
Show answer and explanation
Correct answer: A
Explanation
The best answer is packet fragmentation with Nmap's -f option because the scenario asks for an IDS/firewall evasion technique that still permits normal bidirectional communication. In CEH-relevant practice, common Nmap evasion features include fragmentation (-f), decoys (-D), source port manipulation (--source-port), and timing adjustments, but not all are suitable under every rule of engagement. Decoys and spoofing can interfere with response delivery, making them poor choices when accurate results are required. ACK scanning is for firewall analysis rather than direct service enumeration, and TCP connect scanning is generally noisier. Nmap documentation describes fragmentation as a packet-splitting technique to try to evade simple packet filters and IDS implementations, while also noting that many modern devices normalize or reassemble traffic, limiting effectiveness. This reflects real-world best practice: use evasion techniques only when explicitly authorized, understand their limitations against modern IPS/IDS, and choose methods that align with operational constraints and evidence collection requirements.
- A. Correct.
Correct. Packet fragmentation with Nmap's -f option is a classic IDS/firewall evasion technique intended to split probe packets into smaller IP fragments so some legacy or poorly configured inspection devices may have more difficulty matching simple signatures. In this scenario, it also preserves return traffic to the tester, unlike source spoofing. While modern IDS/IPS devices commonly perform reassembly and may still detect the scan, this is the most appropriate option among those provided because it is an actual evasion-oriented technique that still allows the tester to receive responses.
- B. Incorrect.
Incorrect. Decoys (-D) can make attribution harder by mixing the scanner among additional apparent sources, but using decoys without including your real IP as a decoy means replies are not sent back to you in a way that supports reliable results. The scenario explicitly prohibits spoofed source addresses that break return traffic. This option conflicts with the engagement requirement even though decoys are related to scan obfuscation.
- C. Incorrect.
Incorrect. An ACK scan (-sA) is primarily used to map firewall rule sets and determine whether ports are filtered or unfiltered; it does not enumerate open services in the same way a SYN or connect scan does. Choosing ACK here reflects a common misconception that it is simply a stealthier version of SYN scanning. It serves a different purpose and would not meet the stated service discovery objective.
- D. Incorrect.
Incorrect. A TCP connect scan (-sT) completes the full three-way handshake, which is typically more visible to both the target host and monitoring controls than a half-open SYN scan. It is not an IDS evasion technique and generally increases, rather than reduces, the chance of detection. Someone might choose it because it can work without raw packet privileges, but that is unrelated to evasion.