Another method hackers and penetration testers use to avoid detection is fragmentation. Fragmentation breaks up a message (packet) into tiny pieces. Fragments are put into a network since, these tiny pieces of the messages usually are able to bypass almost any network for security appliance and monitoring tools that are proactively observing network traffic and activities for security threats.
In a fragmentation attack, the attacker can modify the Time to Live (TTL) or the timeout values between each bit sent through the firewall or intrusion-prevention system (IPS). This would cause the security appliance to not easily detect a threat and confuse the device during a reassembly process.
The attack can send fragments of a payload to the victim machine and have it reassemble to a payload without being detected at all.
Nmap allows us to perform port scanning with packet fragmentation on a target device. We can use the nmap –f <target IP address> command:
Using Wireshark, we...