312-50 Question 363
Single answer▪ Evasion TechniquesDuring an authorized internal penetration test, you discover that perimeter IPS devices are dropping your SYN port scans and flagging your source IP after a few seconds of activity. The customer wants you to identify exposed services on a target subnet while minimizing detection by signature-based network defenses. Which approach is MOST appropriate to reduce the likelihood of IDS/IPS detection while still gathering useful port-state information?
- A
Use a TCP connect scan (-sT) at maximum speed with OS detection enabled so the scan finishes before the IPS correlates the activity
- B
Use a slow, randomized scan with increased inter-packet delay and randomize the host and port order to reduce obvious scan patterns
- C
Use an ACK scan (-sA) because ACK scans reliably enumerate open ports without triggering IDS signatures
- D
Use a UDP flood against common service ports first, then follow with a SYN scan after the IPS is saturated
Show answer and explanation
Correct answer: B
Explanation
The best answer is to reduce the scan's detectability by lowering its rate and randomizing its pattern. In practice, tools such as Nmap support timing controls, scan delays, and randomization options that can help avoid simplistic IDS/IPS thresholds based on bursty sequential scans. This aligns with the CEH objective of understanding evasion techniques without resorting to destructive behavior. By contrast, TCP connect scans are typically more visible because they complete handshakes, ACK scans are suited to firewall analysis rather than open-port discovery, and flooding defenses is not a responsible or standard reconnaissance method. Candidates should also recognize that modern IDS/IPS platforms may still detect low-and-slow scanning through correlation and anomaly detection, so evasion techniques reduce likelihood of detection rather than guarantee invisibility. Relevant practical references include Nmap documentation on timing/performance and scan techniques, as well as general IDS/IPS best practices from vendors such as Snort and Suricata regarding scan detection heuristics.
- A. Incorrect.
Incorrect. A TCP connect scan completes the full TCP three-way handshake through the operating system's network stack, which is generally noisier than a SYN scan and easier for defenders to log. Running it at maximum speed and adding OS detection increases the number and distinctiveness of packets, making detection more likely rather than less likely.
- B. Correct.
Correct. Slowing the scan rate, introducing inter-packet delays, and randomizing target order are classic scan evasion techniques against simple threshold- and signature-based IDS/IPS systems. This does not guarantee stealth against modern behavioral analytics, but it is a practical and legitimate method to reduce obvious scan patterns while still collecting useful reconnaissance data.
- C. Incorrect.
Incorrect. ACK scans are primarily used for firewall rule mapping and determining whether ports are filtered or unfiltered; they do not reliably identify open ports. A common misconception is that ACK scans are a stealth substitute for SYN scans for service discovery, but they answer a different question.
- D. Incorrect.
Incorrect. Intentionally flooding the network to overwhelm security controls is disruptive and falls outside normal reconnaissance best practices for a professional penetration test unless explicitly approved for denial-of-service testing. It also increases operational risk and does not represent an appropriate evasion technique for safely identifying exposed services.