IDS/IPS Evasion Techniques

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

TTL Manipulation

Send some packets with a TTL enough to arrive to the IDS/IPS but not enough to arrive to the final system. And then, send another packets with the same sequences as the other ones so the IPS/IDS will think that they are repetitions and won’t check them, but indeed they are carrying the malicious content.

Nmap option: --ttlvalue <value>

Avoiding signatures

Just add garbage data to the packets so the IPS/IDS signature is avoided.

Nmap option: --data-length 25

Fragmented Packets

Just fragment the packets and send them. If the IDS/IPS doesn’t have the ability to reassemble them, they will arrive to the final host.

Nmap option: -f

Invalid checksum

Sensors usually don’t calculate checksum for performance reasons. So an attacker can send a packet that will be interpreted by the sensor but rejected by the final host. Example:

Send a packet with the flag RST and a invalid checksum, so then, the IPS/IDS may thing that this packet is going to close the connection, but the final host will discard the packet as the checksum is invalid.

Uncommon IP and TCP options

A sensor might disregard packets with certain flags and options set within IP and TCP headers, whereas the destination host accepts the packet upon receipt.

Overlapping

It is possible that when you fragment a packet, some kind of overlapping exists between packets (maybe first 8 bytes of packet 2 overlaps with last 8 bytes of packet 1, and 8 last bytes of packet 2 overlaps with first 8 bytes of packet 3). Then, if the IDS/IPS reassembles them in a different way than the final host, a different packet will be interpreted.
Or maybe, 2 packets with the same offset comes and the host has to decide which one it takes.

  • BSD: It has preference for packets with smaller offset. For packets with same offset, it will choose the first one.
  • Linux: Like BSD, but it prefers the last packet with the same offset.
  • First (Windows): First value that comes, value that stays.
  • Last (cisco): Last value that comes, value that stays.

TCP Stream Overlap / Reassembly Mismatch

Like IP fragments, overlapping TCP segments can be reassembled differently by the IDS/IPS and by the destination host. If the sensor and the host disagree on which bytes win in the overlap, you can place benign bytes where the IDS/IPS looks and malicious bytes where the host finally reassembles them.

  • Send a benign segment first and a malicious overlapping segment later (or invert the order) depending on the target OS reassembly policy.
  • Use tiny overlaps to keep the stream valid for the host while maximizing ambiguity for the sensor.

IPv6 Extension Headers & Fragment Tricks

IPv6 allows arbitrary header chains, and the upper-layer (TCP/UDP/ICMPv6) header appears after all extension headers. If a device doesn’t parse the full chain, it can be bypassed by inserting extension headers or by fragmenting so the upper-layer header is not visible where the device expects it. RFC 7112 requires the entire IPv6 header chain to be present in the first fragment; devices that accept non-compliant tiny fragments can be evaded by pushing the L4 header into later fragments.

Practical patterns:

  • Long extension-header chains to push the upper-layer header deeper in the packet.
  • Small first fragments that contain only IPv6 + Fragment + options, leaving the L4 header for later fragments.
  • Combining extension headers + fragmentation to hide the real upper-layer protocol from devices that only inspect the first fragment.

Tools

References

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks