 Here you can find all to build your own Server !!! - Files - Tools - Homepages - Tutorials - Hacks |
     |
Beyond the Perimeter: Evading IDS, Firewalls, and Honeypots in Modern Red Teaming
Understanding evasion is critical because attackers are already doing this. If your red team cannot evade a basic IDS, your blue team will never learn how to hunt.
Modern defenses (Next-Gen Firewalls [NGFW], IPS/IDS, and Deception Networks [Honeypots]) have evolved from simple packet filters into behavioral analysis engines. If you are still running nmap -sS -p- 10.0.0.1 and expecting silence, you are going to set off every alarm in the SOC.
You don't beat a firewall with force. You beat it with legitimacy . You don't beat an IDS with noise. You beat it with timing . And you don't beat a honeypot. You simply walk away . Discussion Question for my network: What is the most creative "evasion" technique you have successfully used during a sanctioned penetration test? (Mine was using DNS over HTTPS [DoH] to exfiltrate data because the firewall allowed *.cloudflare-dns.com .)