In this section we're going to cover different methods that can be used by attackers to compromise networks
and points.
Let's get started with network attacks air reconnaissance attack would be the first move that attackers
would make to gather information about the network.
And that is probably the most popular network scanning tool out there to demonstrate and map.
I'm actually going to use Sparta in our Kelly Linux lab which basically takes and map discovery information
and displays it in a nice gooey application.
And Kelly if you go to applications and then information gathering you can see some of the different
reconnaissance tools that you can use including and map and Sparta.
I'm going to go ahead and click on Sparta and then I run a scan on some devices in the lab.
Now that Sparta has launched I'm going to click here to add a host range.
I'm actually just going to scan a subset of my devices
but in my range and add to scope and as you can see down below it's starting to run and map on that
network range.
This scan will take a while to finish so I'm going to pause recording and we'll pick back up once we
have the scan results.
OK so the map scans are complete.
There are some other tools that Sparta runs on the define host range.
Nicko was a vulnerability assessment tool and then a run screen shot which will take a screenshot of
pages that are open as well as some and checks.
But I mainly wanted to just show you the map results so as you can see in my post column it did discover
some hosts shows their hostname as well as the operating system on some of the hosts.
So this host is a Microsoft Windows Server that I have running in the lab so and map was able to discover
ports and services that are running on that server.
So if I was targeting this network based on running this and map scan I know what type of operating
system this host has as well as services that I could try to exploit
denial of service or distributed denial of service attacks are both ways to overload a network or server.
These network attacks can be launched with the sole purpose of bringing down a network but can also
be used as a method to overwhelm a system to make it vulnerable to other attacks.
The main difference between standard denial of service attacks and distributed denial of service attacks
is with the number of attackers that are participating in the D.O.A. attack.
Well it's taking a look at some of the types of denial of service attacks ICMP floods can be used by
simply sending a large number of ping requests to the target where they spoofed source address.
These can be prevented by blocking unnecessary ICMP traffic on firewalls Syn floods take advantage of
the TCAP three way handshake by sending a flood of TZP send requests without replying to the snack responses
forcing the victim to generate a large amount of unneeded traffic most firewalls can protect against
floods by simply setting limits force an activity DNS amplification attacks are the most common.
DiDio US attack it takes advantage of recursive DNS servers by sending a large amount of DNS requests
for the victim's IP this type of attack can be prevented by making sure that DNS servers are hardened
and do not have recursive lookups enabled.
If they are needed men in the middle attacks are when an attacker finds a way to place themselves in
between a client and their gateway.
When this occurs client data is sent through the attackers device before it is forwarded to the actual
destination.
This can lead to data exfiltration denial of service and password that let's take a look at some common
man in the middle attacks are poisoning can be used by attackers by responding to ARP requests to gateways
causing the victim to send all of their data to the attacker.
Arp poisoning can be prevented with Cisco switches by enabling the dynamic ARP inspection feature.
This feature ensures that malicious our responses are not forwarded across the switch.
Another common man in the middle attack is DHP spoofing with DHP spoofing an attacker would respond
to DGP requests to trick clients into receiving IP addresses from their scope which could then cause
the client to sign gateway traffic to the attacker.
This attack can be prevented.
Well they Cisco switch feature called DHP snooping DHP snooping ensures that only valid DHP server responses
are forwarded across the switch.
The last man in the middle attack that I want to cover is SS ID injection.
This attack can be accomplished by simply deploying a rogue AP with the same access Id ask company broadcasted
SS IDs to avoid SS ID injection.
Make sure to have proper wireless alerts set up so that you're notified if there is rogue AP in the
environment and make sure to have strong authentication policies that would make it difficult for an
attacker to replicate.