IDS/IPS identification
Penetration testers can utilize fragroute
and WAFW00F
to identify if there are any detection or prevention mechanisms put in place, such as Intrusion Detection System (IDS)/Intrusion Prevention system (IPS)/Web application Firewall (WAF).
Fragroute
is a default tool in Kali Linux that does fragmentation. The network packets will allow attackers to intercept, modify, and also rewrite the egress traffic for a specific target. This tool comes in very handy on a highly secured remote environment.
The following screenshot provides the list of options that is available in the fragroute
to determine any network IDs in place:

Attackers can also write their own custom configuration to perform fragmentation attacks to delay, duplicate, drop, fragment, overlap, reorder, source-route, and segment. A sample custom configuration would look like the following screenshot:

Fragroute on target is as simple as running fragroute target.com
and if there are any connections happening to the...