I85PREP
⌘ K
CEH study materials
CEH study resources

CEH: Denial-of-Service, Session Hijacking, and Evading IDS/Firewalls/Honeypots

CEH · Work through your exam, one topic at a time.

All guide sections

Denial-of-Service, Session Hijacking, and Evading IDS/Firewalls/Honeypots

Denial of service

DoS attacks exhaust a resource: bandwidth (volumetric), connection state (protocol), or application processing. Know the classics: SYN flood (half-open connections exhaust the backlog), ICMP smurf (spoofed source plus broadcast amplification), fraggle (UDP echo/chargen variant), ping of death, teardrop (overlapping fragments), UDP/HTTP floods, Slowloris (holds many partial HTTP connections open), and amplification/reflection using DNS or NTP with spoofed source addresses. Distributed attacks use botnets; tools include LOIC/HOIC. Defenses: SYN cookies, rate limiting, throttling, ingress/egress filtering (BCP38), scrubbing centers, and blackhole routing.

Session hijacking

Session hijacking takes over an established session. Forms: TCP/IP hijacking (predict or sniff sequence numbers, spoof a packet, or send RST), blind hijacking, MITM, session sidejacking (steal cookies over unencrypted Wi-Fi), and session fixation (force a known session ID before login). Tools: Bettercap, Burp Suite, Wireshark for token capture. Countermeasures: TLS everywhere, short session timeouts, regenerating session IDs at login, HttpOnly/Secure cookie flags, and IPsec.

IDS/firewall/honeypot evasion

IDS types: NIDS (network sensor) and HIDS (host agent); detection is signature-based (precise, misses new attacks) or anomaly-based (catches novel behavior, more false positives). Evasion techniques: fragmentation and overlapping fragments, insertion and evasion attacks, encoding/obfuscation, tunneling over DNS/ICMP/HTTP, session splicing, polymorphic shellcode, source routing, IP/MAC spoofing, and firewall hops. Nmap flags: -f (fragment), -D (decoys), -sI (idle/zombie scan), --data-length, -T0. A honeypot is a decoy; anything connecting to it is suspicious by definition.

Worked example

A host is flooded with SYNs but never completes handshakes. Rule of thumb: half-open connections equal SYN flood - enable SYN cookies and rate limiting rather than adding bandwidth.