Kali/Layer 4 Attacks - Revision history

Admin: /* DNS DoSing */

2016-08-23T07:43:39Z

DNS DoSing

← Older revision		Revision as of 07:43, 23 August 2016
Line 181:		Line 181:

	==DNS DoSing==		==DNS DoSing==

			{{Main\|DoS/DNS}}

	To DoS a sheep through their DNS channel is fairly straightforward - you simply create a DNS black hole, so that no network requests coming from the sheep can be properly translated to IP addresses. This renders a majority of the sheep's network operations inoperable.		To DoS a sheep through their DNS channel is fairly straightforward - you simply create a DNS black hole, so that no network requests coming from the sheep can be properly translated to IP addresses. This renders a majority of the sheep's network operations inoperable.

Admin: /* DNS Hijacking */

2016-08-23T07:43:23Z

DNS Hijacking

← Older revision		Revision as of 07:43, 23 August 2016
Line 173:		Line 173:

	==DNS Hijacking==		==DNS Hijacking==

			{{Main\|Man in the Midddle/DNS}}

	DNS Hijacking consists in modifying the way the sheep's DNS system works. This can be achieved at multiple levels (e.g., at the system level, by breaking into and modifying the client's system to permanently point to a pirate DNS server; or at the network level, by conducting a MITM attack on DNS requests.) By poisoning routes, the attacker receives the sheep's DNS requests and can respond to specific DNS requests from the sheep to a destination of the attacker's choosing.		DNS Hijacking consists in modifying the way the sheep's DNS system works. This can be achieved at multiple levels (e.g., at the system level, by breaking into and modifying the client's system to permanently point to a pirate DNS server; or at the network level, by conducting a MITM attack on DNS requests.) By poisoning routes, the attacker receives the sheep's DNS requests and can respond to specific DNS requests from the sheep to a destination of the attacker's choosing.

Admin: /* DNS Attacks */

2016-08-23T07:42:59Z

DNS Attacks

← Older revision		Revision as of 07:42, 23 August 2016
Line 172:		Line 172:
	How DNS works: [[Linux/DNS]]		How DNS works: [[Linux/DNS]]

	~~The idea behind a man-in-the-middle~~ DNS attack is that you hijack the sheep's DNS channel - this makes them helpless to your whims unless they can remember the IP address of Google. If you can intercept the sheep's DNS traffic, you can intercept their request to turn a URL like "mail.evilcorp.com/login" into an IP address like "100.250.150.200", and redirect those requests to a server of your own choosing. That server can host a page that looks an awful lot like "mail.evilcorp.com/login" but is actually hosted on the attacker machine. And perhaps when the sheep enters credentials, they can be kicked off the network and their connection killed.		==DNS Hijacking==

	~~A denial of service attack based on~~ DNS ~~would effectively create a black hole~~ into ~~which any~~ and ~~all~~ DNS requests ~~would disappear~~, ~~preventing ''any~~'' DNS ~~traffic~~ from the sheep ~~from reaching out~~. This ~~would,~~ of ~~course, be extremely disruptive~~.		DNS Hijacking consists in modifying the way the sheep's DNS system works. This can be achieved at multiple levels (e.g., at the system level, by breaking into and modifying the client's system to permanently point to a pirate DNS server; or at the network level, by conducting a MITM attack on DNS requests.) By poisoning routes, the attacker receives the sheep's DNS requests and can respond to specific DNS requests from the sheep to a destination of the attacker's choosing.

			Also see [[EvilFOCA]] tool.

			==DNS DoSing==

			To DoS a sheep through their DNS channel is fairly straightforward - you simply create a DNS black hole, so that no network requests coming from the sheep can be properly translated to IP addresses. This renders a majority of the sheep's network operations inoperable.

	=Flags=		=Flags=

Admin: /* DHCP Attacks */

2016-08-23T07:13:03Z

DHCP Attacks

@@ Line 163: / Line 163: @@
 * maintain connection to trusted DHCP
 * identification of new DHCP servers
 =Flags=

Admin: /* Denial of Service */

2016-08-23T07:06:37Z

Denial of Service

← Older revision		Revision as of 07:06, 23 August 2016
Line 64:		Line 64:

	==Denial of Service==		==Denial of Service==

			{{Main\|DoS}}

	There are also ways of creating chaos on Layer 4. For example, suppose an attacker's goal is to create a denial of service on a computer. On the physical layer, or [[Kali/Layer 1 Attacks\|Layer 1]], an attacker would create a denial of service by jamming the radio signal, or physically tampering with a network line. On the transport layer, or Layer 4, a denial of service is created by jamming up the workings of the transport layer. This is done by abusing the TCP handshake protocol.		There are also ways of creating chaos on Layer 4. For example, suppose an attacker's goal is to create a denial of service on a computer. On the physical layer, or [[Kali/Layer 1 Attacks\|Layer 1]], an attacker would create a denial of service by jamming the radio signal, or physically tampering with a network line. On the transport layer, or Layer 4, a denial of service is created by jamming up the workings of the transport layer. This is done by abusing the TCP handshake protocol.

Admin: /* SSL/TLS */

2016-08-23T07:06:18Z

SSL/TLS

← Older revision		Revision as of 07:06, 23 August 2016
Line 44:		Line 44:

	===SSL/TLS===		===SSL/TLS===

			{{Main\|SSL}}

	Passive monitoring can be thwarted through the use of SSL and TLS, both encryption protocols that are implemented on Layer 4. These protocols create a way for computers to transport encrypted packets back and forth, with the packets passing encrypted across the public channel and being decrypted by both parties at either end.		Passive monitoring can be thwarted through the use of SSL and TLS, both encryption protocols that are implemented on Layer 4. These protocols create a way for computers to transport encrypted packets back and forth, with the packets passing encrypted across the public channel and being decrypted by both parties at either end.

Admin: /* Sniffing/Monitoring */

2016-08-23T07:05:58Z

Sniffing/Monitoring

← Older revision		Revision as of 07:05, 23 August 2016
Line 29:		Line 29:

	The transport layer is a rich source of information. You can learn all sorts of things by monitoring network traffic in Wireshark. Often, packet payloads are unencrypted HTTP connections, and contain images, web URLs, and other web content in the clear. This traffic can be monitored by tricking the network into forwarding '''all''' network traffic to an attacker's machine, not just traffic intended for it.		The transport layer is a rich source of information. You can learn all sorts of things by monitoring network traffic in Wireshark. Often, packet payloads are unencrypted HTTP connections, and contain images, web URLs, and other web content in the clear. This traffic can be monitored by tricking the network into forwarding '''all''' network traffic to an attacker's machine, not just traffic intended for it.

			The most common Layer 3/Layer 4 attack is [[ARP Poisoning]], which allows an attacker to redirect traffic at the network transport layer.

			For an implementation of ARP poisoning, see [[MITM Labs/Bettercap SSL Over Wifi]]

	===Packet Sniffing Tools===		===Packet Sniffing Tools===
Line 34:		Line 38:
	Various tools that may be used:		Various tools that may be used:
	* [[Tcpdump]]		* [[Tcpdump]]
	* [[Ettercap]]		* <s>[[Ettercap]]</s>
			* [[Bettercap]]
	* [[Wireshark]]		* [[Wireshark]]
	* [[Dsniff]]		* [[Dsniff]]
Line 44:		Line 49:
	===SSLStrip===		===SSLStrip===

	{{Main\|Man in the Middle~~/SSLStrip~~}}		{{Main\|SSLStrip}}

			Active sniffing/monitoring attacks force sheep to use insecure protocols like HTTP instead of HTTPS. [[SSLStrip]] is an example of an active monitoring Layer 4 Transport attack. The intent is to actively tamper with the content stream the sheep is receiving in order to strip out any content that would redirect the sheep to the more secure HTTPS protocol. This enables a [[Man in the Middle]] attack at Layer 4.

			===SSLSniff===

			{{Main\|SSLSniff}}

			SSLSniff is a slightly different tool that focuses on serving up certificates. Whereas [[SSLStrip]] focuses on bypassing HTTPS, avoiding the need to present certificates, SSLSniff is for those who are attempting to present valid certificates to the sheep.

	~~Active sniffing/monitoring~~ attacks ~~force sheep to use insecure protocols like HTTP instead of HTTPS~~. ~~[[SSLStrip]] is an example of an active monitoring Layer 4 Transport attack. The intent is to actively tamper~~ with the ~~communication stream in order to force the usage~~ of ~~insecure protocols and enable a~~ [[~~Man in the Middle~~]] ~~attack at Layer 4~~.		Moxie0 has shown several attacks against SSL certification checking mechanisms. Other attacks may be attempted, and carried out, with the help of [[SSLSniff]].

	==Denial of Service==		==Denial of Service==

Admin: /* SSLStrip */

2016-08-20T23:52:49Z

SSLStrip

← Older revision		Revision as of 23:52, 20 August 2016
Line 44:		Line 44:
	===SSLStrip===		===SSLStrip===

	{{Main\|SSLStrip}}		{{Main\|Man in the Middle/SSLStrip}}

	Active sniffing/monitoring attacks force sheep to use insecure protocols like HTTP instead of HTTPS. [[SSLStrip]] is an example of an active monitoring Layer 4 Transport attack. The intent is to actively tamper with the communication stream in order to force the usage of insecure protocols and enable a [[Man in the Middle]] attack at Layer 4.		Active sniffing/monitoring attacks force sheep to use insecure protocols like HTTP instead of HTTPS. [[SSLStrip]] is an example of an active monitoring Layer 4 Transport attack. The intent is to actively tamper with the communication stream in order to force the usage of insecure protocols and enable a [[Man in the Middle]] attack at Layer 4.

Admin: /* Session Hijacking */

2016-08-20T23:45:40Z

Session Hijacking

← Older revision		Revision as of 23:45, 20 August 2016
Line 73:		Line 73:

	More info: https://en.wikipedia.org/wiki/Smurf_attack		More info: https://en.wikipedia.org/wiki/Smurf_attack

	~~==Session Hijacking==~~

	Session hijacking involves an attacker taking control of an ongoing session between two nodes. This is possible because authentication happens only at the start of a conversation. Thus an attacker masquerades as an end node of the session and hijacks the session.

	==DHCP Attacks==		==DHCP Attacks==

Admin: /* DHCP Attacks */

2016-08-20T23:45:15Z

DHCP Attacks

← Older revision		Revision as of 23:45, 20 August 2016
Line 79:		Line 79:

	==DHCP Attacks==		==DHCP Attacks==

			{{Main\|Man in the Middle/DHCP}}

	{{Main\|DoS/DHCP}}		{{Main\|DoS/DHCP}}
Line 114:		Line 116:

	===Rogue DHCP Server Attack===		===Rogue DHCP Server Attack===

			{{Main\|Man in the Middle/Rogue DHCP}}

	{{Main\|DoS/Rogue DHCP}}		{{Main\|DoS/Rogue DHCP}}
Line 142:		Line 146:
	* The attacker is the DNS server, meaning they can monitor and/or tamper with DNS requests from the client, and redirect them to, e.g., fake versions of various websites.		* The attacker is the DNS server, meaning they can monitor and/or tamper with DNS requests from the client, and redirect them to, e.g., fake versions of various websites.

	~~Coutermeasures~~:		Countermeasures:
	* DHCP snooping		* DHCP snooping
	* maintain connection to trusted DHCP		* maintain connection to trusted DHCP