Ravi Sir's Cyber Security Cards › Revision Cards
Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly
Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly Old tricks to slip past a simple IDS: split the attack across packets ( fragmentation ) or disguise it ( encoding ). A naive sensor that reads one packet at a time never sees the full attack pattern. URL encoding hides keywords from we
Read card text
What this card says
What it is
Old tricks to slip past a simple IDS: split the attack across packets (fragmentation) or disguise it (encoding).
How it works
A naive sensor that reads one packet at a time never sees the full attack pattern.
URL encoding hides keywords from weak filters.
Defence
Modern sensors reassemble fragments and normalise encoding before matching.
Keep your IDS updated so it reassembles traffic.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Splits payload across fragments / segments (classic idea) | Enable defrag + stream reassembly; alert on anomalies |
| Double-encodes a string so cheap content:"../" misses | App-layer parsers; WAF normalization; deny odd encodings |
| Overlaps fragments hoping IDS and OS disagree | Policy: drop invalid fragments at firewall; keep IDS in… |
Learn more in the lesson: 42.3 Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly