Kali/Layer 3 Attacks - Revision history

Admin: /* Byzantine Attack */

2017-09-09T08:15:41Z

Byzantine Attack

← Older revision		Revision as of 08:15, 9 September 2017
Line 63:		Line 63:
	{{Main\|DoS/Byzantine Attack}}		{{Main\|DoS/Byzantine Attack}}

	In a Byzantine attack, a set of intermediate ~~(def?)~~ nodes are compromised by an attacker, and attacks are carried out to interfere with the normal flow of traffic through the intermediate node. This may involve creating routing loops to slow down traffic, re-routing packets on non-optimal paths, or dropping packets. These types of attacks are hard to detect.		In a Byzantine attack, a set of intermediate nodes are compromised by an attacker, and attacks are carried out to interfere with the normal flow of traffic being passed through the intermediate node. This may involve creating routing loops to slow down traffic, re-routing packets on non-optimal paths, or dropping packets. These types of attacks are hard to detect.

	==Information Leaks==		==Information Leaks==

2017-09-09T08:14:17Z

Wormhole Attack

← Older revision		Revision as of 08:14, 9 September 2017
Line 47:		Line 47:
	Note: this is classified as a [[DoS]] attack, but it is a general technique that can be used in a variety of different attack types.		Note: this is classified as a [[DoS]] attack, but it is a general technique that can be used in a variety of different attack types.

	~~Another type of~~ network-layer attack ~~is one~~ in which the attacker creates a wormhole between two networks - all network traffic received is tunneled ~~(possibly selectively)~~ to another location in the network, where the packets are rebroadcast. This can be accomplished through the use of network device tunneling, for example, forwarding all traffic from one network device (like wifi antenna number 1) to another (like wifi antenna number 2).		Wormhole attack is a network-layer attack in which the attacker creates a wormhole between two networks - all (or selected) network traffic received is tunneled to another location in the network, where the packets are rebroadcast. This can be accomplished through the use of network device tunneling, for example, forwarding all traffic from one network device (like wifi antenna number 1) to another (like wifi antenna number 2).

	(It is not totally clear what you can do with these types of attacks, but it's basically tampering with the network topology.)		(It is not totally clear what you can do with these types of attacks, but it's basically tampering with the network topology.)

2017-09-09T08:13:28Z

Tampering With Traffic

← Older revision		Revision as of 08:13, 9 September 2017
Line 39:		Line 39:
	==Tampering With Traffic==		==Tampering With Traffic==

	To modify traffic on the fly, you can use..~~. ???~~		To modify traffic on the fly, you can use any number of tools. [[Bettercap]] or [[MITMf]] are probably the most straightforward and most capable tools.

	==Wormhole Attack==		==Wormhole Attack==

2016-08-20T23:55:57Z

Flags

2016-08-20T23:41:26Z

Sniffing Traffic

← Older revision		Revision as of 23:41, 20 August 2016
Line 33:		Line 33:
	==Sniffing Traffic==		==Sniffing Traffic==

	{{Main\|~~Dsniff~~}}		{{Main\|Man in the Middle/Sniffing}}

	If you intend to sniff traffic, you can also use [[Dsniff]].		If you intend to sniff traffic, you can also use [[Dsniff]]. Notes on the page linked to above are on how to use Dsniff to sniff traffic in a man in the middle attack.

	==Tampering With Traffic==		==Tampering With Traffic==

2016-08-20T23:39:21Z

NDP Spoofing

← Older revision		Revision as of 23:39, 20 August 2016
Line 89:		Line 89:
	==NDP Spoofing==		==NDP Spoofing==

	NDP is the IPv6 replacement for ARP in IPv4.		{{Main\|Man in the Middle/NDP Spoofing}}

			NDP is the IPv6 replacement for ARP in IPv4.

	==Routing Attacks==		==Routing Attacks==

2016-08-20T23:38:44Z

Tampering On The Fly

← Older revision		Revision as of 23:38, 20 August 2016
Line 37:		Line 37:
	If you intend to sniff traffic, you can also use [[Dsniff]].		If you intend to sniff traffic, you can also use [[Dsniff]].

	==Tampering ~~On The Fly~~==		==Tampering With Traffic==

	~~{{Main\|MITM/Tampering}}~~		To modify traffic on the fly, you can use... ???

	~~If you want to tamper with~~ traffic, ~~or view images passing through a traffic stream live,~~ use... ???

	==Wormhole Attack==		==Wormhole Attack==

2016-08-20T23:38:23Z

Sniffing for Goodies

← Older revision		Revision as of 23:38, 20 August 2016
Line 31:		Line 31:
	If your intention is to monitor a sheep's traffic, you can use [[ARP Poisoning]] to reroute traffic at the network/router level so that you intercept all communications intended for the sheep. This allows you to tamper with all traffic, or just listen to everything. This is a low level of involvement, and involves modifying ARP lookup tables (which associate IP addresses to MAC addresses) so that computers send traffic intended for the sheep to your computer instead.		If your intention is to monitor a sheep's traffic, you can use [[ARP Poisoning]] to reroute traffic at the network/router level so that you intercept all communications intended for the sheep. This allows you to tamper with all traffic, or just listen to everything. This is a low level of involvement, and involves modifying ARP lookup tables (which associate IP addresses to MAC addresses) so that computers send traffic intended for the sheep to your computer instead.

	==Sniffing ~~for Goodies~~==		==Sniffing Traffic==

	{{Main\|Dsniff}}		{{Main\|Dsniff}}

2016-08-20T23:37:32Z

ARP Poisoning

← Older revision		Revision as of 23:37, 20 August 2016
Line 27:		Line 27:
	==ARP Poisoning==		==ARP Poisoning==

	{{Main\|ARP Poisoning}}		{{Main\|Man in the Middle/ARP Poisoning}}

	If your intention is to monitor a sheep's traffic, you can use [[ARP Poisoning]] to reroute traffic at the network/router level so that you intercept all communications intended for the sheep. This allows you to tamper with all traffic, or just listen to everything. This is a low level of involvement, and involves modifying ARP lookup tables (which associate IP addresses to MAC addresses) so that computers send traffic intended for the sheep to your computer instead.		If your intention is to monitor a sheep's traffic, you can use [[ARP Poisoning]] to reroute traffic at the network/router level so that you intercept all communications intended for the sheep. This allows you to tamper with all traffic, or just listen to everything. This is a low level of involvement, and involves modifying ARP lookup tables (which associate IP addresses to MAC addresses) so that computers send traffic intended for the sheep to your computer instead.

2016-08-20T23:35:54Z

Routing Attacks

← Older revision		Revision as of 23:35, 20 August 2016
Line 82:		Line 82:

	A sleep deprivation attack involves consuming battery power on another node by creating a flood of packets, preventing the radio from sleeping and consuming significant additional power.		A sleep deprivation attack involves consuming battery power on another node by creating a flood of packets, preventing the radio from sleeping and consuming significant additional power.

			==Port Stealing==

			{{Main\|Man in the Middle/Port Stealing}}

			Port stealing is a technique similar to ARP spoofing, in which an attacker confuses the router about traffic destination, but it works on a single port level. This enables stealing traffic for a node on a network that is on a particular port.

			==NDP Spoofing==

			NDP is the IPv6 replacement for ARP in IPv4.

	==Routing Attacks==		==Routing Attacks==