Networking Equipment Flashcards
7 commonly used protocols for remote management of devices?
- Telnet
- Web based protocols (HTTP, HTTPS)
- SSH
- SNMP
- TFTP
- Cisco Reverse Telnet
- NTP
Management Protocols - Telnet?
- Not encrypted, all plain text
Management Protocols - Web Based Protocols
HTTP (HyperText Transfer Protocol)
- Not encrypted, all plain text
HTTPS
- Secure, TLS 1.3 is latest version - 1.2 vulnerable
Management Protocols - Secure Shell
- Secure, depends on encryption
- can log in with uname and password or without if have the private key
Management Protocols - SNMP (Simple Network Management Protocol)
- Used by Network Management Systems (NMS) to monitor network infrastructure
- SNMPv1 is unencrypted
SNMPv3 (latest) is encrypted
SNMP could leak credentials and other data.
If there is write access - remote code execution is possible
Management Protocols - TFTP (Trivial File Transfer Protocol)
- Simple to implement
- No authentication or access control mechanisms
Management Protocols - Cisco Reverse Telnet
- Allows the Telnet server to write to a computer terminal or device
Telnet - Network to network
Reverse telnet - network to serial (hardware communication)
Management Protocols - NTP (Network Time Protocol)
- Used to synchronise clock between computer systems in a network (UDP port 123)
- Could leak system info, host names of network, etc.
nmap -sU -sV –script “ntp* and (discovery or vuln) and not (dos or brute)” -p 123 <target_ip></target_ip>
What would you use for local network traffic analysis?
Wireshark
Raw data can be seen at each different layer:
Frame -> Ethernet -> IPv4 -> Http
This shows hexdumps of data.
Files can be extracted from PCAP files.
How to extract HTTP files?
- Open the .pcap file
- File -> Export Objects -> HTTP…
- Choose what you want to save
How to extract FTP files?
- Filter for FTP-DATA packets
- Right-click -> Follow -> TCP Stream
- Select RAW as the output type
- Save the file
What is ARP?
Description and Security issues?
Address resolution Protocol (ARP)
Discovers MAC addresses in the network.
No authentication
ARP Spoofing - pretends to be another computer for man in the middle attacks.
What is DHCP?
Description and Security issues?
Dynamic Host Configuration Protocol (DHCP)
Automatically assigns IP addresses to new devices in the network.
Commonly found in routers.
No Authentication required, can be used for man-in-the-middle attacks or unauthorised access to resources or DoS
What is CDP?
Description and Security issues?
Cisco Discovery Protocol (CDP)
Used to share info about other directly connected Cisco equipment, such as OS version and IP address.
Information leakage
What is HSRP?
Description and Security issues?
Hot Standby Router Protocol (HSRP)
Provides redundancy for routers through virtual MAC addresses etc.
DoS, take over active router.
What is VRRP?
Description and Security issues?
Virtual Router Redundancy Protocol (RVVP)
Provides redundancy for routers through virtual MAC addresses, but incomplete.
DoS, take over active router
What is VTP?
Description and Security issues?
VLAN Trunking Protocol (VTP)
Cisco Protocol
Sends VLAN info to whole of LAN.
VTP-bomb
Network uses config with highest config revision number.
If a new switch is added to a network with correct VTP domain name and password, but the switch has a higher revision number, the whole network will use the VTP info from the new switch, which will overwrite the current config.
What is STP?
Description and Security issues?
Spanning Tree Protocol (STP)
Helps network traffic flow with less congestion, saving resources
No security issues
What is TACACS+ ?
Description and security issues?
Terminal Access Controller Access Control System Plus
Provides authentication, authorisation and accounting (AAA) services to the network.
No security issues.
Enumeration and fingerprinting of
IPSec 500/UDP
nmap -sU -p 500 <target_ip>
ike-scan -M <target_ip></target_ip></target_ip>
Enumeration and fingerprinting of
VoIP (Voice over IP)
5060 UDP/TCP unencrypted
5061 UDP/TCP encrypted
Similar to HTTP, request-response model, with use-agent and URIs
7 Common request types within SIP
- INVITE - invites an account to join the call
- ACK - confirmation regarding the invite of joining the call
- CANCEL - cancelling a queued call
- REGISTER - registering the user against the SIP server
- OPTIONS - shows the options the caller has
- BYE - ends the call between both sides
- REFER - shows that the receiver needs to communicate through a 3rd party by the info attached to the request
6 SIP requests/responses
1xx - informational
2xx - success
3xx - redirection
4xx - failed requests
5xx - web server cannot complete request
6xx - global errors
SIP interaction structure (6 steps)
- Sender initiates an INVITE request
- Receiver sends back a 100 (trying) response
- Sender starts ringing by sending a 180 (ringing) response
- Receiver picks up the phone and a 200 success response is sent (OK)
- ACK is sent by the initiator
- Call started using RTP
- BYE request sent to end the call
Wired Equivalent Privacy (WEP)
Deprecated and easily cracked and passwords can be extracted once initialisation vector (IV) are captured.
Standard 64-bit WEP uses a 40 bit key (also known as WEP-40) which is concatenated with a 24-bit IV to form the RC4 key.
Temporal Key Integrity Protocol (TKIP)
Replacement for WEP
Early versions not recommended for use
Was rebranded as WPA
TKIP implements a key mixing function that combines the secret root key with the initialisation vector before passing it to the RC4 cipher initialisation
Wi-Fi Protected Access WPA/WPA2
If wi-fi password is weak - it’s easy to crack and find the passwords
WPA - 2003 - interim measure for WEP
WPA2 - 2004 - more secure version
WPA3 - 2018 - after security issues raised
Keys are pre-shared
Extensible Authentication Protocols (EAP/LEAP/PEAP)
What is EAP?
EAP is an authentication framework used in LANs and dial-up connections.
Used mainly in wireless communication for authentication among clients and wireless LAN.
As a P2P (point-to-point) LAN data communication framework - EAP provides range of authentication mechanisms, such as supporting one-time passwords (OTPs), smart cards, public key encryption authentication and digital certificateds
EAP Flow
- Using a transceiver, the client requests a wireless connection
- The transceiver gets client requests a wireless connection
- The authenticator then requests client ID from the transceiver and when it’s received then sends a message to the client requesting client ID
- When verified, the client ID is sent to the server
LEAP (Lightweight Extensible Authentication Protocol)
Authentication framework used by WPA, WPA2 and WPA3.
Built by Cisco - but no longer recommended for use by Cisco
PEAP (Protected Extensible Authentication Protocol)
Authentication framework used by WPA, WPA2 and WPA3
Similar to EAP-TLS, which is EAP over TLS config for security.
Recommended for use.
Jointly developed by Cisco, Microsoft and RSA Security
