The ICMP is used for diagnostic purposes and it's widely available virtually every local network uses
the protocol and few people block its packets even administrators really analyze these packets.
Network intrusion detection systems to CERN the ICMP packets but don't analyze their contents as you
can see in the picture above.
You can send data in ICMP packets if you're connected to the network and wanted to send something so
that the administrator wouldn't notice you could use the ICMP packets for that no one and nothing would
block this data or analyze the contents of the packets you sent.
This is because nobody expects any data in these packets.
Usually there is none on the web you can find about a dozen programs that allow you to send text or
binary codes using ICMP.
How then can you secure yourself against vulnerabilities in the third layer of the OSA model.
One of the solutions consists of dividing the network into smaller segments called subnets we'll elaborate
on that later on.
Another is monitoring all packets passing through the layer to ensure that no packets are sent or received
without your control.
You have to monitor IP and ICMP packets.
The third method of protection involves taking into account that IP version 6 is a dynamic protocol.
If you don't need automatic routing configuration for example you don't switch servers between networks.
You should either disable it or limited.
You should also limit the list of IP addresses of routers you'll accept advertisements from the network
layers the first layer of the OSA model that can be secured using protocols.
And that's where you can see the basic protocol because it works in the third layer.
It's less visible for applications working in the seventh layer.
We'll discuss the upset rules during one of the next lectures
now demonstrate how to impersonate somebody by changing your IP address and how easy it is to disable
the computer by advertising false IP version 6 routes.
We'll also learn how easy it is to perform IP spoofing in order to hide the IP of the computer used
remote scanning
will use the map program.
This is a tool that allows you to perform various types of scanning such as TCAP scanning an IP an IP
protocol scanning which will be discussed later.
It can also be used for IP and Mac spoofing IP version 6 can and can also be performed
first will hide the real mac address we'll change it to a random address chosen from.
For example the pool of addresses of Apple network cards.
Then will hide the real IP address.
We'll use IP addresses which will be interpreted by the victim as computers that try to establish connections
with it.
To make it convincing We must use only the addresses of computers currently on line at the moment.
We're sure that the computer identified by IP number 1 9 2 1 6 8 0 1 15 is online.
We can also use and map to generate a number of random addresses to use.
We have to type the real address in as well.
If all packets had false addresses in the sender IP address field we wouldn't get a response from the
victim's computer we're trying to perform the scan on.
As a result we will learn nothing about it.
If the real address comes sixth or seventh most network intrusion detection systems won't save it for
efficiency reasons the systems usually only save the first five addresses.
Which use the scan type.
For example TCAP still scan.
Also we have to select the port we would like to scan which is standard TCAP ports ranging from 1 to
1024.
The last thing we have to do is determine the scan target in a later part of the seminar.
We'll learn how to monitor data passing through the network using wireshark network analyzer.
I highly recommend you return to this exercise once you get to know the program with wireshark enabled
on the server you perform the scan on.
You'll be able to see which sender IPs show up on the computer being scanned.
It'll turn out that there's more than one six for example only the six IP will identify the computer
that actually performed the scan because only six of the packets sent returned to us.
The scan will take longer when it's finished.
We should be able to observe TCAP ports on the target host ranging from 1 to 1024 or open.
Let's have a closer look at one of the tools that are included in backtrack.
We can see here a couple of tools that send IP version 6 rudder advertisements one of these tools is
called Floyd rodder 6.
The only thing we have to provide in the program is the interface through which the advertizements need
to be sent before you execute the command that you see in the picture.
It's advisable that you save all the documents you're working on because it will crash all the local
network hosts that support IP version 6 protocol all of the computers that will be affected are running
under Vista and Windows 7.
We analyzed the first three layers of the OS model the physical layer the data Linkletter and the network
layer.
We also learned about the vulnerabilities characteristic of each layer and the ways to mitigate those
vulnerabilities which is the topic we will also elaborate on during the next modules.
Thank you for your attention.