Sniffing and Evasion Flashcards
From a legal standpoint, sniffing is equivalent to:
Wiretapping
MAC address
Physical or burned in address of a network interface. 48 bits long, 12 hex characters separated by colons
MAC address format
First 3 bytes are the organization unique identifier or NIC manufacturer code. The last 3 bytes are unique within the manufacture code.
NIC must run in this mode to sniff all frames
Promiscuous mode. Driver like WINPCAP for Windows systems is required and libpcap for Linux systems.
Collision Domain
All the devices sharing any given transport medium.
Why switches can restrict sniffing
Switches restrict visibility of network conversations by splitting each port into its own collision domain.
Hardware Protocol Analyzers
Fluke, RADCOM, Keysight
Which protocol passes everything in clear text?
TFTP as well as SNMP and NTP prior to V3, also IMAP and POP3, HTTP
Address Resolution Protocol (ARP)
Maps IP addresses to MAC addresses by sending an ARP_REQUEST. The relevant system will respond with an APR_REPLY and provide its MAC address.
Display current ARP cache
ARP -a
Delete entries from the ARP cache
ARP -d * or NETSH interface ip delete arpcache
Technique of spoofing a MAC address
Sending a gratuitous ARP
Unicast
A packet addressed to a single device
Multicast
A packet addressed to a group of devices
Anycast
A packet addressed to a group, but the nearest device in terms of routing distance opening it.
IPV6 Link Local address
FE80 - equivalent to APIPA
IPV6 Unique Local address
fc00::/7: Equivalent to private IPV4 addresses
IPV6 Global addresses
Equivalent to public IPV4 addresses
Lawful Interception
Process of legally intercepting communications between two or more users for surveillance of telecommunications, VOIP and multiservice networks
Planning Tool for Resource Integration (PRISM)
US data tool for collecting foreign intelligence
Passive sniffing
Plugging in a sniffer and capturing what is seen but limited to a collision domain
Active sniffing
Packet injection, port spanning also known as port mirroring to open up other collision domains. Some routers only allow a port to be mirrored for read and not for transmit
MAC flooding
Force a switch’s content addressable memory (CAM) table to fill up after which subsequent traffic will be flooded to all ports. Also known as switch port stealing
ARP poisoning
Also known as ARP spoofing and gratuitous ARP. Process of maliciously changing an ARP cache on a machine to inject faulty entries,
Arp flooding tools
Cain and Abel,
WinArpAttacker,
Ufasoft,
Dsniff (Arpspoof)
DHCP Starvation
Exhaust all leased out addresses on a DHCP server. Form of Denial of Service. Tools: yersinia, dhcpstarv Configure DHCP snooping on the DHCP server to mitigate this attack. DHCP snooping is a layer 2 security technology built into the operating system of a capable network switch that drops DHCP traffic determined to be unacceptable. The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients.
Rogue DHCP server attack
An attacker sets up his own DHCP server and hands out IP addresses and options to control communications.
MAC address spoofing
Some OS/drivers allow you to change it on the NIC, You can also use a tool like SMAC
Switch Port Security
Manually assign a MAC address to a port. Network admins can also restrict the number of MAC addresses associated with a port. If more, the port switch will amber out.
ICMP Router Discover Protocol (IRDP) spoofing
A hacker sends spoofed IRDP packets to change the gateway.
Wireshark filters
!protocol - filter out the protocol
http.request - displays all HTTP GET
tcp contains string - shows all TCP packets with that string
ip.addr= =ip address && tcp.port= = port
ip.addr= =ip address or ip.addr= = ip address
Wireshark TCP Filters
tcp.flags= =0xn where n: 1 = FIN 2 = SYN 4 = RST 8 = PSH 16 =ACK 32 = URG
Put tcpdump in listening mode
tcpdump -i eth0
Tool that can be used to analyze packet captures from tcpdump, WindDump,Wireshark and Etherpeek
tcptrace
Intrusion Detection System (IDS)
Hardware and or software devices that examine streams of packets for unusual or malicious behavior sometimes via signature list and sometimes via anomaly (learned behavior) list. A signature based IDS is only as good as the signature list. An anomaly based IDS can produce false positives. Snort is an IDS
Libwhisker
A Perl library used for HTTP-related functions including vulnerability scanning and IDS evasion. Used by NIKTO
False Negative - from an IDS perspective
Occurs when an IDS reports an intrusion as fine. Worse than a false positive,
Host based IDS (HIDS)
Resides on a host and not on the network. HIDS are often signature based, HIDS examples:
Tripwire,
Cybersafe,
Norton Internet Security
Host Based Security System (HBSS)
The Host Based Security System (HBSS) is the official name given to the United States Department of Defense (DOD) commercial-off-the-shelf (COTS) suite of software applications used within the DOD to monitor, detect, and defend the DOD computer networks and systems. The Enterprise-wide Information Assurance and computer Network Defense Solutions Steering Group (ESSG) sponsored the acquisition of the HBSS System for use within the DOD Enterprise Network. HBSS is deployed on both the Non-Classified Internet Protocol Routed Network (NIPRNet) and Secret Internet Protocol Routed Network (SIPRNet) networks, with priority given to installing it on the NIPRNet. HBSS is based on McAfee, Inc’s ePolicy Orchestrator (ePO) and other McAfee point product security applications such as Host Intrusion Prevention System (HIPS).
Network Intrusion Detection System (NIDS)
NIDS sit on the network perimeter and watch traffic coming into and leaving the network.
SNORT
Open source IDS, powerful sniffer, traffic logging, and protocol analyzing tool that can detect buffer overflows, port scans, operating system fingerprinting. Rule sets (signatures) are updated often. Snort can run in three different modes: Sniffer Mode, Packet Logger Mode and IDS Mode.
IDS will have difficulty detecting malicious activity if:
The traffic is encrypted or obfuscated by decoys,
Network Tap
A connection that lets you see all traffic going by it. Place it in the correct location and make sure it is rated for the expected throughput.
Snort Configuration file - snort.conf
Resides in /etc/snort on Linux and c:\snort\etc on Windows and contains a list of rule sets to engage at startup.
Snort HOME_NET
Variable that defines the local network
Snort Rule
Single line in the configuration file and contains an action, a protocol, the rule format direction which could be bidirectional, a source address/port, a destination address/port and message parameters. The Snort rule action can be Alert, Log,or Pass.
Firewall
A device that is designed to protect internal resources from unauthorized external access. Firewalls work with both explicit and implicit rules. Also, rule location matters as a match on a rule may end the rule processing.
Packet filtering firewalls
Examine the header to make a forward or drop decision
Stateful inspection firewalls
Tracks the entire status of a connection. Also known as stateful multilayer inspection. From the Network to the Application layer.
Circuit level firewall
Works at the session layer
Application level firewall
Works as an application proxy
HTTP tunneling
A firewall evasion technique used by hackers to tunnel their traffic over port 80.
HTTP beacons
Communicating with Command and Control using http
IDS Evasion Techniques
Go slow, deploy decoys and fake attacks to flood, use fragmentation, use Unicode characters
IDS Evasion Tools
Nessus, ADMmutate, NIDSbench (fragmentation), Inundator (flooding tool), IDS Informer (can use captured traffic to craft an IDS evasion). Packet Generator and PackETH.
Firewall Discovery and Evasion
ICMP Type 3, Code 13 shows traffic is being filtered by a firewall
ICMP Type 3, Code 3 - the client has a port closed
Firewall Informer can discover the location of firewalls.
Firewalking
Determine which ports are open on a firewall. NMAP, Firewalk, CovertTCP, ICMP Shell, 007 Shell
Honeypot
A system set up as a decoy to entice attackers. Needs to be walled off from other systems.
High Interaction Honeypot
Simulates all services and applications designed to be completely compromised. Symantec, Decoy Server, and Honeynets
Low Interaction Honeypot
Simulates a limited number of services and will not be completely compromised by design.
Specter,
Honeyd and
KFSensor
DHCP Packets
DHCPDISCOVER,
DHCPOFFER,
DHCPREQUEST,
DHCPACK
