Network weaknesses
Each classic attack on a local network and on the Internet with its remedy: sniffing, MAC table flooding, ARP spoofing, rogue DHCP server, VLAN hopping, IP spoofing, SYN flood, DNS poisoning, cleartext protocols.
- 33 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
- Understand
A few cards from the deck
ARP spoofing: what is it?
Show the answer
Sending forged ARP replies so that a machine's IP address, often the gateway's, gets associated with the attacker's MAC address.
ARP authenticates nothing and accepts even an unsolicited reply: the victim's cache is overwritten. Remedy: dynamic ARP inspection on the switch, which checks each reply against observed DHCP leases.
Here is the ARP cache of a host whose gateway is 192.168.1.1. Which sign betrays spoofing?
```text
$ arp -a
? (192.168.1.1) at 02:00:00:aa:aa:aa [ether] on eth0
? (192.168.1.20) at 02:00:00:aa:aa:aa [ether] on eth0
? (192.168.1.34) at 08:00:27:5c:11:2e [ether] on eth0`- The gateway and a host share the same MAC address
- The MAC addresses start with 02, reserved for forged addresses
- The 192.168.1.34 entry has no associated gateway
- The
[ether]type shows the entry was injected by hand
Show the answer
The gateway and a host share the same MAC address
A MAC address belongs to a single card, but several IPs can legitimately map to it (a router, a multi-address server). A gateway and a host sharing the same MAC is the cache of an attacker answering for both.
In a SYN flood, the attacker never sends the last message of the TCP handshake, the …; the server keeps … connections.
Show the answer
In a SYN flood, the attacker never sends the last message of the TCP handshake, the ACK; the server keeps half-open connections.
The handshake has three messages: SYN, SYN-ACK, ACK. The attack stops at the second, which already makes the server reserve memory.
MAC table flooding: what is it?
Show the answer
Sending thousands of frames with made-up source addresses to fill a switch's memory, which then no longer knows where to place machines.
With memory full, the switch broadcasts on all ports the frames it can no longer place, and the attacker reads other people's traffic. Remedy: port security, which limits the number of MAC addresses per port.