Sybex CEH Certified Ethical Hacker Version 8 Study Guide

388 Chapter 16 ■ Evading IDSs, Firewalls, and Honeypots
4. Perform a DoS.
5. Use code obfuscation.
6. Perform a false positive generation technique.
7. Attempt a Unicode attack.
8. Perform a fragmentation attack.
It is important for you to remember that not every attack will work when testing a
firewall or IDS, but you should still log the results and make note of the way the devices
respond. When testing is completed, compare and analyze the results to see if you can
determine any patterns or behavior that may indicate the nature of the environment or
vulnerabilities present.
Summary
In this chapter we looked at firewalls, IDSs, and honeypots as mechanisms used to defend
a network as well as something to evade as an attacker. You saw that the problem is that
whereas many attacks are effective at getting information, they can be thwarted by using
any of the systems we have covered. In fact, today’s networks and environments employ a
range of defensive and detective measures designed to deal with such attacks.
Today’s corporations use many defensive measures, each with its own way of putting a
stop to attacks. Systems such as intrusion detection systems, intrusion prevention systems,
firewalls, honeypots, and others form very potent adversaries and obstacles to your
activities. Although these devices are formidable they are not insurmountable, so you must
first learn how they work and then see what you can do to overcome the obstacles or just
get around them altogether.
Exam Essentials
Understand the different types of firewalls. Know that not all firewalls are the same and
that each operates a little differently. For example, packet filtering firewalls work at the
network level and are commonly found embedded in routers, whereas stateful firewalls are
devices unto themselves.
Know the differences between HIDSs and NIDSs. Understand that an HIDS and an
NIDS are not the same and do not monitor the same type of activity. An NIDS monitors
traffic on a network, but diminishes in effectiveness where a host is concerned. An HIDS
has diminishing capability outside of a specific host.
Understand the role of a honeypot. A honeypot is a tool used to attract an attacker for
the purpose of research, acting as a decoy, or to gain intelligence as to what types of attacks
you may be facing and how well your defenses are working.