Sybex CEH Certified Ethical Hacker Version 8 Study Guide

Honeypots, IDSs, and Firewalls 387
An attacker can leverage this by sending packets with the ACK flag set using a tool such
as AckCmd.
HTTP Tunneling
An additional variation of the tunneling method involves exploiting the HTTP protocol.
This method may be one of the easiest ones to use mainly due to the fact that the HTTP
protocol is already allowed through many firewalls as part of normal operation. HTTP
traffic is considered normal due to the requirement for just about every company to have
Internet access or provide access to resources such as web servers and web applications to
the public and as such it does not appear abnormal.
One tool that may be used to exploit this situation is HTTPTunnel, which uses a clientserver
architecture to facilitate its operation.
Testing a Firewall and IDS
With so many techniques and mechanisms at your disposal, you can now test your
defensive and monitoring capabilities.
Overview of Testing a Firewall
The following are the general steps and process for testing the integrity and capability of a
firewall, whether it is based on hardware or software:
1. Footprint the target.
2. Perform port scanning.
3. Perform banner grabbing against open ports.
4. Attempt firewalking.
5. Disable trusted hosts.
6. Perform IP address spoofing.
7. Perform source routing.
8. Substitute an IP address for a URL.
9. Perform a fragmentation attack.
10. Use an anonymizer.
11. Make use of a proxy server to bypass a firewall.
12. Use ICMP tunneling.
13. Use ACK tunneling.
Overview of Testing an IDS
Much like testing a firewall, there is a general process for testing an IDS. It tends to be
something like the following:
1. Disable trusted hosts.
2. Attempt an insertion attack.
3. Implement evasion techniques.