This lecture covers networking basics, sniffing and spoofing techniques, ARP poisoning, the Heartbleed vulnerability, and reverse shells. The next lecture will cover firewalls, DNS attacks, and TCP/UDP attacks.
Outline
IP Address and Network Interface
TCP/IP Protocols
Packet Sniffing
Packet Spoofing
ARP Protocol and Attacks
Reverse Shells
IP Address
IP Address: The Original Scheme
Different classes of IP addresses:
Class A: From 0.0.0.0 to 127.255.255.255. First bit is 0.
Class B: From 128.0.0.0 to 191.255.255.255. First two bits are 10.
Class C: From 192.0.0.0 to 223.255.255.255. First three bits are 110.
Class D: From 224.0.0.0 to 239.255.255.255. First four bits are 1110. Used for multicast.
Class E: From 240.0.0.0 to 255.255.255.255. First four bits are 1111. Reserved for future use.
CIDR Scheme (Classless Inter-Domain Routing)
CIDR notation: 192.168.60.5/24 indicates that the first 24 bits are the network ID.
Question: What is the address range of the network 192.168.192.0/19?
Special IP Addresses
Private IP Addresses:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
Loopback Address:
127.0.0.0/8
Commonly used: 127.0.0.1
List IP Address on Network Interface
Command: $ ip -br address
Example output:
lo UNKNOWN 127.0.0.1/8 ::1/128
enp0s3 UP 10.0.5.5/24 fe80::bed8:53e2:5192:f265/64
docker0 DOWN 172.17.0.1/16 fe80::42:13ff:fee7:90d6/64
Manually Assign IP Address
Commands:
$ sudo ip addr add 192.168.60.6/24 dev enp0s3
$ ip addr
Automatically Assign IP Address
DHCP: Dynamic Host Configuration Protocol
Get IP Addresses for Host Names: DNS
Command: $ dig www.example.com
The dig command queries DNS servers to obtain domain name information, such as IP addresses.
Network Stack
Packet Journey at a High Level
A packet travels from source A to destination B through multiple routers and networks.
How Packets Are Constructed
Application Layer: Data
Transport Layer: Adds TCP or UDP header.
Network Layer: Adds IP header.
MAC Layer: Adds MAC header. NIC then transmits the data over the network
Layer 4: Transport Layer
Includes source port and destination port.
TCP or UDP header.
Layer 3: Network Layer
Constructs packet with source IP and destination IP addresses, then routes it.
Layer 2: Data Link Layer (MAC Layer)
Adds destination MAC address and source MAC address.
Sending Packet in Python (UDP Client)
Code: python
#!/usr/bin/python3
import socket
IP = "127.0.0.1"
PORT = 9090
data = b'Hello, World!'
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(data, (IP, PORT))
Execution Results:
$ nc -luv 9090
Listening on [0.0.0.0] (family 0, port 9090)
Hello, World!
Receiving Packets in Python (UDP Server)
Code: python
#!/usr/bin/python3
import socket
IP = "0.0.0.0"
PORT = 9090
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind((IP, PORT))
while True:
data, (ip, port) = sock.recvfrom(1024)
print("Sender: {} and Port: {}".format(ip, port))
print("Received message: {}".format(data))
Example:
Terminal 1 sends "hello" and "hello again" to the server.
Terminal 2 (server) receives and prints the messages along with the sender's IP and port.
How Packets Are Received
Reverse process of sending; involves the NIC, MAC Layer, Network Layer (routing), Transport Layer (port), and finally the Application.
Routing
Routing Table
The ip route Command
Examples:
# ip route
# ip route get 10.9.0.1
# ip route get 192.168.60.5
# ip route get 1.2.3.4
Packet Sending Tools
Using netcat:
$ nc <ip> <port> (TCP packet)
$ nc -u <ip> <port> (UDP packet)
$ echo "data" > /dev/udp/<ip>/<port>
$ echo "data" > /dev/tcp/<ip>/<port>
Others: telnet, ping, etc.
Packet Sniffing
How Packets Are Received for Sniffing
Link-level driver copies packets to a ring buffer. Protocol stack and user space access the packets from there, enabling the capture of network traffic.
Packet Sniffing Tools
Tcpdump: Command-line tool, suitable for containers.
Wireshark: GUI tool, suitable for environments supporting a GUI.
Packet Spoofing
Overview
Normal packet construction: OS sets most header fields, users control a few.