Ethical Hacking, Volume 12

Intrusion detection systems, firewalls and honeypots are there to catch an attacker. Volume 12 shows how attackers try to get past them, and how to make sure they don't. It opens with what each of these defenses is and why it matters, then looks at IDS, IPS, firewall and honeypot solutions together: their advantages and disadvantages, and how they work as one system.

The chapter on evading IDS covers encryption, traffic fragmentation and obfuscation, protocol-level evasion, polymorphic malware, timing-based attacks, tunneling, evasion tools, zero-day exploits and coordinated attacks. The chapter on evading firewalls covers port scanning and port hopping, protocol tunneling, application-layer evasion, IP spoofing, encrypted traffic and rule manipulation, with countermeasures. A chapter on evasion tools explains how they work and how to block them. The honeypot chapter separates production and research honeypots and high- and low-interaction designs, explains why they are deployed, and shows how attackers detect them. The last chapter brings the countermeasures together. A glossary closes the book, and chapters end with discussion questions and a quiz.

After reading it, you will be able to explain how IDS, firewalls and honeypots work together, recognize the main evasion techniques, and configure defenses that hold up against them.