Score Common TCP/IP Attacks Flashcards
TCP/IP include for main protocols ?
Ip
TCP
UPD
ICMP
What is a MITM attack ?
An MITM attack intercepts communication between two systems. Essentially, the attacker inserts a device into a network that grabs packets that are streaming past. Those packets are then modified and placed back on the network for forwarding to their original destination.
What is Session Hijacking ?
Session hijacking is a twist on the MITM attack. The attacker gains physical access to the network, initiates a MITM attack, and then hijacks that session. In this manner, an attacker can illicitly gain full access to a destination computer by assuming the identity of a legitimate user. The legitimate user sees the login as successful but then is cut off. Subsequent attempts to log back in might be met with an error message that indicates that the user ID is already in use.
what is Ip address spoofing ?
Attackers spoof the source IP address in an IP packet. IP spoofing can be used for several purposes. In some scenarios, an attacker might want to inspect the response from the target victim (non-blind spoofing); in other cases, the attacker might not care (blind spoofing). Blind IP address spoofing is most frequently used in DoS attacks. Some reasons for non-blind spoofing include sequence-number prediction, hijacking an authorized session, and determining the state of a firewall.
Describe a DoS attack
an attacker attempts to prevent legitimate users from accessing information or services. By targeting your computer and its network connection, or the computers and network of the sites that you are trying to use, an attacker may be able to prevent you from accessing email, websites, online accounts, or other services that rely on the affected computers.
What is a DDos
A DDoS attack is a DoS attack that features a simultaneous, coordinated attack from multiple source machines. The best-known example of a DDoS attack is the “smurf” attack.
What is a Resource exhaustion attack ?
Resource exhaustion attacks are forms of DoS attacks. These attacks cause the server’s or network’s resources to be consumed to the point where the service is no longer responding, or the response is significantly reduced. By targeting IP routers, an attacker may adversely affect the integrity and availability of the network infrastructure, including end-to-end IP connectivity. Router resources that are commonly affected by packet flood attacks include the following: CPU, packet memory, route memory, network bandwidth, and vty lines.
a connectionless protocol that is mainly used to route information across the internet
an IP
a connectionless protocol that does not use any port number and works on the network layer
ICMP
What does ICMP unreachables mean ?
ICMP unreachables are commonly used by attackers to perform network reconnaissance. In cyber security, network reconnaissance refers to the act of scanning the target network to gather information about the target.
What is ICMP mask reply ?
A feature that malicious insiders or outsiders can use to map your IP network. This feature allows the router to tell a requesting endpoint what the correct subnet mask is for a given network.
describe an ICMP redirect attacks ?
A router uses IP redirects to inform the sender of a better route to a destination, intended for hosts on its directly connected networks. However, attackers can exploit this to send an ICMP redirect to a victim’s host, redirecting all traffic through a router they control. This ICMP redirect attack is a type of MITM attack, where the attacker intercepts all communication between the source and destination.
What is ICMP router discovery ?
ICMP Router Discovery Protocol (IRDP) allows hosts to locate routers that can be used as a gateway to reach IP-based devices on other networks. Because IRDP does not have any form of authentication, it is impossible for end hosts to tell whether the information they receive is valid or not. Therefore, an attacker can perform a MITM attack using IRDP.
What is Firewalk ?
Firewalking is an active reconnaissance technique that employs traceroute like techniques to analyze IP packet responses to determine the gateway access list filters and map out the networks.
What is ICMP tunneling ??
An ICMP tunnel creates a hidden connection between two remote computers using ICMP echo requests and replies. This method can bypass firewall rules by disguising traffic within ICMP packets. Without deep packet inspection or log review, detecting this type of tunneling traffic is difficult.
what is ICMP-based operating system fingerprinting
Operating system fingerprinting identifies the OS running on a device. ICMP can be used for active scanning; for example, a TTL value of 128 typically indicates a Windows machine, while a TTL of 64 suggests a Linux-based system.
what are the DoS service attacks that use ICMP
ICMP flood attack
Smurf attack
What is a ICMP flood attack
The attack overwhelms the targeted resource with ICMP echo request packets, large ICMP packets, and other ICMP types to significantly saturate and slow down the victims network infrastructure.
Which information can an attacker use within the ICMP to determine which type of operating system the device is running?
total length
TTL value
version
checksum
TTL value
Which option is used to establish a covert connection between two remote computers, using ICMP echo requests and reply packets, and which can be used to bypass firewall rules?
Smurf attack
Firewalking
ICMP tunneling
ICMP-based operating system fingerprinting
ICMP tunneling
Which application-layer protocol that uses UDP to manage and monitor devices on the network could be exploited if it is not secured on devices?
TFTP
SNMP
HTTPS
FTP
SMTP
SNMP
what is the UDP Vulnerabilities with checksum ?
Optional and easily recomputed, making it vulnerable to alteration by attackers.
What are the different UDP Vulnerabilities ?
Checksum:
Source Verification
Eavesdropping
No Encryption
What are common UDP attacks ?
Dos Attacks
Source IP spoofing
The total sum of all the vulnerabilities in a given computing device or network that are accessible to the attackers.
Attack surface
Attack surface may be categorized into different areas, such as software attack surfaces (open ports on a server), physical attack surfaces (USB ports on a laptop), network attack surfaces (console ports on a router)
The paths or means by which the attackers gain access to a resource (such as end-user hosts or servers) to deliver malicious software or malicious outcome
Attck vector
What are the four categories that attack surfaces are divided into ?
The network attack surface
The software attack surface
The physical attack surface
The social engineering attack surface
What is the network attack surface ?
The network attack surface comprises all vulnerabilities that are related to ports, protocols, channels, devices (smartphones, laptops, routers, and firewalls), services, network applications, and even firmware interfaces.
What does CVE stand for ?
Common Vulnerabilites and Exposures
What is the software attack surface ?
It is the complete profile of all functions in any code that is running in a given system that is available to an unauthenticated user.
An attacker or malware can exploit various vulnerabilities to gain access and execute code on a target machine. The software attack surface includes applications, email services, configurations, databases, executables, DLLs, web pages, mobile apps, device OS, and more.
What is the physical attack surface ?
The physical attack surface is composed of the security vulnerabilities in a given system that are available to an attacker in the same location as the target.
The physical attack surface is exploitable through inside threats such as rogue employees, social engineering ploys, and intruders who are posing as service workers.
What is social engineering attack surface ?
It is usually takes advantage of human psychology: the desire for something free, the susceptibilty to destractionm or the desire to be loked or to be helpful .
What is Reconnaissance ?
The attacker attempts to gather information about targeted computers or networks that can be used as a preliminary step toward a further attack seeking to exploit the target system
what are known vulnerabilities ?
The attacker finds a weakness in hardware and software and then exploits those vulnerabilities. There are several online resources that publish information about vulnerabilities that have been discovered in different systems. Often, a proof-of-concept attack code will be provided with the vulnerability disclosure.
What is a SQL injection ?
This attack works by manipulating the SQL database queries that the web application sends. An application can be vulnerable if it does not sanitize user input properly or uses untrusted parameter values in database queries without validation.
What is Phishing ?
The attacker sends out spam emails to thousands of recipients. The email contains a link to a malicious site that has been set up to look like, for instance, a regular bank’s site.
What is malware ?
Short for “malicious software,” malware may be computer viruses, worms, Trojan horses, dishonest spyware, and malicious rootkits.
What is a Weak authentication attack ?
These attacks exploit weak authentication, such as guessable passwords, lack of account lockout after failed attempts, or insecure password reset methods.
cWhich two options might be considered attack surfaces in the network environment? (Choose two.)
open ports
privacy settings
use of SSH
use of Telnet
Use of Telnet
Open ports
Which type of a common security threat can be solved by patching the operating system or hardware device?
phishing
SQL injection
malware
known vulnerabilities
weak authentication
known vulnerabilities
An attempt to learn more about the intended victim before attempting a more intrusive attack, such as actual access or DoS.
A reconnaissance attack
What are four main subcategories or methods for gathering network data
Packet sniffers / packet analysis,
Ping sweeps
port scans
information queries
What is packet sniffing ?
its the process of capturing any data this is passed over the local network and looking for any information that may be useful to an attacker.
What are ping sweeps ?
ping sweep is another kind of network probe. In a ping sweep, the attacker sends a set of ICMP echo packets to a network of machines, usually specified as a range of IP addresses, and sees which ones respond.
