CCT: Network Attacks

Reconnaissance Attacks

Before launching any network attack, adversaries gather intelligence about the target network. Reconnaissance attacks aim to discover as much information as possible without triggering alerts.

Techniques used:

• Social Engineering
• Port Scanning
• DNS Footprinting
• Ping Sweeping

Information targeted:

• Domain names and internal domain names
• Network blocks and IP address ranges
• Rogue or private websites
• Open ports and running services
• Operating system versions and architectures
• TCP and UDP services in use
• Access control mechanisms and ACLs
• VPN endpoints and firewall configurations
• Analog and digital telephone numbers
• Authentication mechanisms and system uptime

Network Scanning

Network scanning is a set of procedures for identifying live hosts, open ports, and running services across a network. It forms a core component of the intelligence-gathering phase.

Network Scan Results
├── Live Hosts and IP Addresses
├── Open Ports per Host
├── Operating System and Architecture
├── Services Running on Each Host
└── Vulnerabilities in Live Hosts

Scanners like nmap enable attackers to build a complete profile of an organization's exposed infrastructure before deciding where to attack.

DNS Footprinting

DNS records reveal critical information about server types, locations, and network topology. Attackers use DNS footprinting to map key infrastructure.

A **DNS zone file transfer** (AXFR) provides a complete dump of all DNS records for a domain — a goldmine for attackers if misconfigured to allow public transfers.

Tool commonly used: DNSdumpster

DNS Poisoning

DNS cache poisoning is the unauthorized manipulation of IP address entries in a DNS resolver's cache. A corrupted DNS entry silently redirects users from a legitimate domain to a malicious website.

Normal DNS:
User --> DNS Resolver --> Legitimate Server

DNS Poisoned:
User --> DNS Resolver (poisoned cache) --> Attacker's Server

Domain Hijacking

Domain hijacking is an attack where the ownership of a domain is changed without the consent of the legitimate owner. Attackers infiltrate the domain registrar account using phishing or social engineering to transfer the domain to infrastructure they control.

Packet Sniffing

Packet sniffing is the process of monitoring and capturing all data packets passing through a network using a software application or hardware device.

It allows an attacker to observe and access the entire network traffic stream, gathering sensitive information such as:

• Telnet passwords (transmitted in cleartext)
• Email traffic and attachments
• Syslog messages
• Session tokens and credentials

Tools like Wireshark and tcpdump can be used legitimately for network troubleshooting but are equally useful for malicious capture.

Man-in-the-Middle (MITM) Attacks

A MITM attack intrudes into an existing connection between two systems and intercepts the messages being exchanged. The attacker splits the TCP connection into two:

Normal:
Client <-----------------------> Server

MITM:
Client <--> [Attacker] <--> Server

This allows the attacker to:

• Read all traffic in transit
• Modify messages before they reach the destination
• Insert fraudulent data into the communication

Tool commonly used: Cain & Abel

ARP Spoofing Attack

ARP (Address Resolution Protocol) maps IP addresses to physical MAC addresses on a local network. ARP spoofing involves sending a large number of forged ARP responses to poison the ARP cache of target machines.

By impersonating ARP responses, the attacker convinces other hosts to send traffic to the attacker's MAC address instead of the legitimate destination, achieving a classic MITM position.

Legitimate ARP:
192.168.1.1 is at AA:BB:CC:DD:EE:FF

Poisoned ARP:
192.168.1.1 is at [Attacker's MAC]  <-- forged entry

ARP spoofing is a Layer 2 attack and is highly effective on unswitched or misconfigured networks.

DHCP Starvation Attack

A DHCP starvation attack floods a DHCP server with fake DHCP requests using spoofed MAC addresses, exhausting the entire pool of available IP addresses. The result is a Denial of Service — legitimate hosts cannot obtain IP addresses from the flooded server.

DHCP Spoofing Attack

Following a DHCP starvation attack, the attacker sets up a rogue DHCP server on the network. When legitimate clients request IP configuration, the rogue server responds first with attacker-controlled settings (including a malicious default gateway or DNS server).

Attack Sequence:
1. DHCP Starvation: knock out the legitimate DHCP server
2. Rogue DHCP Server: respond to new requests
3. Traffic Redirection: clients route through attacker infrastructure

MAC Spoofing

MAC spoofing involves changing a network interface's MAC address to impersonate another device. Attackers sniff the network for active MAC addresses associated with switch ports, then re-use one of those addresses.

Common uses:

• Circumventing MAC-based wireless access controls
• Hiding the attacker's true physical address
• Bypassing network access control (NAC) systems

MAC Flooding

MAC flooding overwhelms a Layer 2 switch's CAM table (Content Addressable Memory) with fake MAC address and IP pairs until it is full. When the CAM table overflows, the switch can no longer make forwarding decisions and falls back to broadcasting all traffic to every port — effectively behaving like a hub.

This allows the attacker to capture all traffic on the network segment.

# macof floods the switch's CAM table with bogus MAC entries
# Can generate approximately 131,000 entries per minute
macof -i eth0 -n 10

IP Spoofing

IP spoofing involves changing the source IP address of a packet so the attack appears to originate from a different machine. When the victim responds, the reply goes to the spoofed address rather than the real attacker.

# Example using hping3 to spoof source IP
hping3 www.certifiedhacker.com -a 7.7.7.7

IP spoofing is used extensively in DoS amplification attacks and to obscure the true origin of attack traffic.

DoS and DDoS Attacks

A Denial-of-Service (DoS) attack reduces, restricts, or prevents accessibility of system resources to legitimate users by flooding the victim with non-legitimate requests or traffic.

DoS  --> Single source attacker
DDoS --> Multiple sources (Botnet of 100 to 1000s of devices)

A Distributed Denial-of-Service (DDoS) attack uses a botnet to amplify attack traffic, making it much harder to filter or block because requests come from thousands of different source IPs.

Tool commonly used: hping3

DRDoS — Distributed Reflection DoS

A Distributed Reflection Denial-of-Service (DRDoS) attack (also known as a spoofed attack) uses multiple intermediary machines to reflect attack traffic toward the target.

Attacker spoofs victim's IP --> Sends to intermediary hosts
Intermediary hosts respond to victim's IP --> Traffic floods victim

The attacker never directly contacts the victim, making attribution extremely difficult.

Malware Attacks on Networks

Malware is also deployed as a network attack vector. Once a system is compromised, malware can:

• Pivot laterally to other systems on the network
• Disrupt services and degrade system performance
• Gather sensitive information including credentials and financial data
• Create backdoors for persistent remote access

Common malware used in network attacks: viruses, Trojans, adware, spyware, rootkits, and backdoors

Advanced Persistent Threats (APTs)

APTs are long-term, stealthy network attacks where an attacker gains unauthorized access to a target network and remains undetected for an extended period to extract sensitive information.

Common APT targets:

• Classified government documents
• User credentials and access tokens
• Credit card and financial data
• Business strategy and intellectual property

APTs are typically associated with nation-state actors or highly sophisticated criminal groups who have the resources for sustained, targeted operations.

Physical Network Attacks

Attackers do not always need network access to compromise a system:

• Malicious USB Cables — deliver payloads on connection
• Malicious Flash Drives — auto-execute malware when inserted
• Card Cloning — duplicate magnetic stripe cards
• Skimming — capture card data from ATMs or point-of-sale terminals

Adversarial AI

Adversarial AI is an emerging attack vector where malicious actors design inputs specifically crafted to mislead AI and machine learning models — causing misclassification, evasion, or data poisoning in security tools that rely on AI-driven detection.