module 11
https://medium.com/@Mx0o14/tryhackme-network-security-solutions-evasions-8a14de2dcc1
https://viblo.asia/p/su-dung-php-query-string-parser-de-qua-mat-ids-ips-va-waf-3P0lP9Yo5ox
# IPS/IDS
## Evading
### Insertion attack
Gửi một packet không hợp lệ.
Vd: gửi từng kí tự, thì những kí tự cần bỏ ta set TTL chỉ đi đến dc IDS mà không đi đến dc destination. vậy thì IDS sẽ có nhiều word hơn và làm detect sai.
Hoặc sửa bằng checksum thì target PC sai checksum sẽ không nhận. IDS vẫn nhận
Other name: Invalid packet
https://www.yeahhub.com/top-6-techniques-to-bypass-an-ids-intrusion-detection-system/
https://insecure.org/stf/secnet_ids/secnet_ids.html
### Evasion
IDS receive more packet than destination. Because IDS block some bytes.
https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-network/ids-evasion
### Compression
### ASCii shellcode

# Firewall
circruit level gateways: check which data stream, session rule(3 way handshakes) are allowed.
## bypass block url
## Proxy server
## Tunelling
read more (page 99 module 12)
https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding

# Prevent
## Intrusion detection
### Yara rule
### Snort
### suricata
## Intrusion Detection Tools for Mobile Devices (52)
## Honeypot

# NAC
## Evasion
### VLAN Hopping
include demo

# Detect Honeypot