Merge pull request #1993 from HackTricks-wiki/research_update_src_generic-methodologies-and-resources_pentesting-network_ids-evasion_20260312_170734

Research Update Enhanced src/generic-methodologies-and-resou...

Author: carlospolop

src/generic-methodologies-and-resources/pentesting-network/ids-evasion.md

@@ -41,10 +41,35 @@ Or maybe, 2 packets with the same offset comes and the host has to decide which
 - **First** (Windows): First value that comes, value that stays.
 - **Last** (cisco): Last value that comes, value that stays.
 
+
+## **TCP Stream Overlap / Reassembly Mismatch**
+
+Like IP fragments, **overlapping TCP segments** can be reassembled differently by the IDS/IPS and by the destination host. If the sensor and the host disagree on **which bytes win** in the overlap, you can place benign bytes where the IDS/IPS looks and malicious bytes where the host finally reassembles them.
+
+- Send a benign segment first and a **malicious overlapping segment** later (or invert the order) depending on the target OS reassembly policy.
+- Use **tiny overlaps** to keep the stream valid for the host while maximizing ambiguity for the sensor.
+
+## **IPv6 Extension Headers & Fragment Tricks**
+
+IPv6 allows **arbitrary header chains**, and the upper-layer (TCP/UDP/ICMPv6) header appears **after** all extension headers. If a device doesn’t parse the full chain, it can be bypassed by inserting extension headers or by fragmenting so the upper-layer header is not visible where the device expects it. RFC 7112 **requires the entire IPv6 header chain to be present in the first fragment**; devices that accept non-compliant tiny fragments can be evaded by pushing the L4 header into later fragments.
+
+Practical patterns:
+
+- **Long extension-header chains** to push the upper-layer header deeper in the packet.
+- **Small first fragments** that contain only IPv6 + Fragment + options, leaving the L4 header for later fragments.
+- Combining **extension headers + fragmentation** to hide the real upper-layer protocol from devices that only inspect the first fragment.
+
 ## Tools
 
 - [https://github.com/vecna/sniffjoke](https://github.com/vecna/sniffjoke)
+- [https://github.com/secdev/scapy](https://github.com/secdev/scapy)
+
+
+
+## References
 
+- [https://www.rfc-editor.org/rfc/rfc7112](https://www.rfc-editor.org/rfc/rfc7112)
+- [https://www.rfc-editor.org/rfc/rfc9098](https://www.rfc-editor.org/rfc/rfc9098)
 
 {{#include ../../banners/hacktricks-training.md}}