42. Evading IDS, Firewalls and Honeypots – Detection Games
42.3 Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly
Purana trick (awareness, not a lab recipe): split the malicious bytes across IP fragments or TCP segments so a naive sensor that looks at one packet never sees the full signature. Similar family: URL encoding, chunked HTTP, compression, overlapping fragments that confuse old stacks.
Modern Blue (Snort stream5 / preprocessor family, Suricata stream + http parsers, many NGFWs):
- IP defragmentation + TCP stream reassembly before the rule runs
- HTTP normalization (decode
%41→A, reassemble chunks) - Drop or alert on invalid / overlapping fragments (often more useful than "allow weird")
- Don't turn the stream engine off "because CPU" without a written exception
Aapan fragroute / tiny-fragment attack runbooks nahi det na – production bypass nahi. Lab madhe prove: normal Nmap still lands in fast.log when Suricata is healthy. Encoding lesson = Blue enables parsers, not Red "how to hide from Snort".
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Splits payload across fragments / segments (classic idea) | Enable defrag + stream reassembly; alert on anomalies |
Double-encodes a string so cheap content:"../" misses |
App-layer parsers; WAF normalization; deny odd encodings |
| Overlaps fragments hoping IDS and OS disagree | Policy: drop invalid fragments at firewall; keep IDS in sync with OS |
Ravindra Bagale's Tip
On YouTube students say "nmap -f = IDS is dead". It sometimes worked against old sensors – today reassembly is the default. Interview: "I describe fragmentation as a reason we reassemble, not as a trick I run on customer nets." Don't worry – concept yes, kit no.
Ravindra Bagale's Tip – मराठी
Students YouTube वर "nmap -f = IDS dead" म्हणतात. जुन्या sensors वर कधी कधी चालले – आज reassembly default आहे. Interview: "I describe fragmentation as a reason we reassemble, not as a trick I run on customer nets." घाबरू नका – concept yes, kit no.
Ravindra Bagale's Tip – हिंदी
Students YouTube पर कहते हैं "nmap -f = IDS dead". पुराने sensors पर कभी-कभी चला – आज reassembly default है. Interview: "I describe fragmentation as a reason we reassemble, not as a trick I run on customer nets." घबराओ मत – concept yes, kit no.
Lab
Read-only: open Suricata/Snort docs for stream / defrag (or your lab suricata.yaml comments). Tick three boxes: defrag on, reassembly on, HOME_NET correct. Screenshot yaml (no secrets). Do not install fragment-attack tools.
Real incident: SolarWinds / SUNBURST (2020)
In December 2020, FireEye publicly reported a supply-chain intrusion: a trojanized SolarWinds Orion component (SUNBURST) that, after a dormant wait reported as up to about two weeks, talked to C2 in a way designed to blend with legitimate SolarWinds traffic (public reporting: masquerade as Orion Improvement Program / OIP-style protocol, DNS-based coordinator, later HTTPS). Signed software + "looks like the monitoring vendor" is classic evasion of human and signature trust, not a cute nmap flag. Weakness: implicit trust in vendor updates; C2 that resembled admin tooling; delayed beaconing that beats short SOC windows. Defence: egress allow-lists, DNS logging, code-integrity / SBOMs, hunt for rare child processes of admin suites, don't ignore "trusted" channels. Source: FireEye/Mandiant SUNBURST public write-ups (2020) and major coordinated reporting (verify; say "reported" for dwell and victim counts).