Hello, guys, and welcome to another video
for this chapter in this video, we are going to give short
light on the Christmas tree Attack. A Christmas tree.
Attack sent a large number of specially crafted TCP packets to incentivize and has
all the options set so that any protocol can be used.
The name is derived from the idea that all
the settings are turned to on within the packet.
So it is lit up like a Christmas tree.
Christmas tree packets are also known as kamikaze packets and lab test segments.
Christmas tree attacks require much more
processing by routers and devices than other packets.
Not numbers of these packets
can use so much processing power that it ties up this device is effectively making
any other task nearly impossible, thus denying service to legitimate traffic.
Receiving these types of packets is not
usable and therefore should be regarded as suspicious.
Intrusion Detection
System can detec this packet as to some firewalls.
The TCP packet contains many flags,
synchronization, acknowledgement, fin flag reset, urgent pointer and push.
Out of all these flags in the Christmas tree, Attack especially crafted TCP Packet
were urgent puch and Fin flags stand down are sent in a normal situation.
This combination of these flags.
Out of all these flags in a Christmas
tree, Attack especially grafted TCP packet were urgent push and flags stand down.
In a normal situation.
The combination of these flags with bits
stand on is not sent upon sending such packets.
The target devices may respond differently.
As different operating systems may react
differently, it can be used for operating system, fingerprinting port
state and other information, once it gets the information, you can look
for potential loopholes and vulnerabilities in the network.
So as you can see from this photo presented in the slide, when you are
looking into the packets themselves, you can see
if this combination of bits turned on and off right inside each packet.
We're going to explore and see this practically while we are performing an
Attack and capturing the traffic on our packet machine.
We can write some custom code that craft
the required packet to perform certain Attack.
And the code will look something like this code presented on this slide.
We can also use the hping3 command and the command structure will be looking
something like I have on this slide now we will analyze this Attack using the
popular nmap scan and capture the traffic, as we said, with Wireshark on our target
machine and see with our own eyes, how the packet looks like.
So we are in our Linux machine, which is
going to be the Attack machine, and we are ready to type the
nmap command and use the appropriate flags for the Christmas tree Attack.
And we are going to attack the Windows system that I have in my lap.
So let's go ahead and type the Nmap command.
We are going to use the
Christmas tree flag for nmap, which is dash small s capital X.
Small s capital X and then we type the IP
of the Attack of the target machine, which in this case is my Windows system.
Before you present and perform the Attack,
remember to go into your windows machine open Wireshark, select the network you
want to capture the traffic from and start capturing the packet
so in a in my Windows system in my lap, I have already opened the Wireshark and it's
capturing the traffic already and we can now just go ahead and press, enter and
perform the Attack on our local windows system.
So when the Attack
will finish, we are going straight to our Windows system and stop the
traffic capture and we can investigate all the packets going there.
So as you can see, the Nmap Christmas tree Scan stopped.
So let's go to our Windows machine,
stop the capture and see what's going on there.
So I stopped the network up to now in our Windows system.
And we can go through all the packets
and find the packages are part of the Christmas tree Attack.
If you're doing this by, it is
practically impossible to see these type of Attack
with all the other normal traffic that is going through your network,
which makes it very important to have this intrusion prevention systems that were.
When someone is performing certain Attack,
you will be able to see the alarm immediately.
So why don't you spot the
Christmas tree, packets you can see that they are all going together.
And they're starting from a specific port on our attacking machine, and it's
automizing the set of ports on our system, as you can see.
So let's just choose one of those and go through and check the flags,
you can see that the flags are in the transmission control protocol and.
You can expand these.
And see the fin psh urgent flags.
So you can see the reserved not set the echo not set said the urgent set
push push set syn not set is not set and fin is set.
You can see that whatever packet you choose.
Well, this scan is being performed they
look the same with the same with the same set of combinations happening.
As we mentioned earlier,
these Attack is very easy to see if you have an Intrusion Prevention System as
these systems have signatures that are specifically designed to identify
Christmas tree attacks when they are going through your network.
There are also some IP Tables rules if you're using a Linux
system on your home or your work that you can protect from these Attack.
So as you see, so as you see, there are a few IP tables,
rules presented on the slide you can use to protect your Linux system machine.
And remember that Intrusion Prevention System are very important and are the
systems that you need to identify properly the Christmas tree attacks.
So that was it for this video.
And now you can go ahead and press on the next video.
Where you are going to learn how to
decrypt SSL and TLS traffic using Wireshark.