Network attacks and defenses : a hands-on approach

452 Pages·2013·22.733 MB·xxxi, 443 p. : ill ; 24 cm\452

by  Zouheir Trabelsi, et al

Network Attacks
and Defenses
A Hands-on Approach
OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
Asset Protection through Security FISMA Principles and Best Practices:
Awareness Beyond Compliance
Tyler Justin Speed Patrick D. Howard
ISBN 978-1-4398-0982-2 ISBN 978-1-4200-7829-9
The CISO Handbook: A Practical Guide Information Security Governance
to Securing Yuor Company Simplified: From the Boardroom to
Michael Gentile, Ron Collette, and the Keyboard
Thomas D. August Todd Fitzgerald
ISBN 978-0-8493-1952-5 ISBN 978-1-4398-1163-4
CISO’s Guide to Penetration Testing: Information Technology Control
A Framework to Plan, Manage, and and Audit, Fourth Edition
Maximize Benefits
Sandra Senft, Frederick Gallegos, and
James S. Tiller
Aleksandra Davis Request
ISBN 978-1-4398-8027-2
ISBN 978-1-4398-9320-3
Cybersecurity: Public Sector Threats
Managing the Insider Threat:
and Responses
No Dark Corners
Kim J. Andreasson, Editor
Nick Catrantzos
ISBN 9781-4398-4663-6
ISBN 978-1-4398-7292-5
Cyber Security Essentials
Noiseless Steganography:
James Graham, Editor
The Key to Covert Communications
ISBN 978-1-4398-5123-4
Abdelrahman Desoky
Cybersecurity for Industrial Control ISBN 978-1-4398-4621-6
Systems: SCADA, DCS, PLC, HMI,
Secure and Resilient Software:
and SIS
Requirements, Test Cases, and
Tyson Macaulay and Bryan L. Singer
Testing Methods
ISBN 978-1-4398-0196-3
Mark S. Merkow
Cyberspace and Cybersecurity
ISBN 978-1-4398-6621-4
George Kostopoulos Request
ISBN 978-1-4665-0133-1 Security De-Engineering: Solving
the Problems in Information Risk
Data Mining Tools for Malware
Management
Detection
Ian Tibble
Mehedy Masud, Latifur Khan, and
ISBN 978-1-4398-6834-8C
Bhavani Thuraisingham
ISBN 978-1-4398-5454-9 The Security Risk Assessment
Handbook: A Complete Guide
Defense against the Black Arts: How
for Performing Security Risk
Hackers Do What They Do and How to
Assessments, Second Edition
Protect against It
Jesse Varsalone and Matthew McFadden Douglas Landoll
ISBN 978-1-4398-2119-0 ISBN 978-1-4398-2148-0
Digital Forensics for Handheld Devices The 7 Qualities of Highly Secure
Eamon P. Doherty Software
ISBN 978-1-4398-9877-2 Mano Paul
ISBN 978-1-4398-1446-8
Electronically Stored Information:
The Complete Guide to Management, Smart Grid Security: An End-to-End
Understanding, Acquisition, Storage, View of Security in the New
Search, and Retrieval Electrical Grid
David R. Matthews Gilbert N. Sorebo and Michael C. Echols
ISBN 978-1-4398-7726-5 ISBN 978-1-4398-5587-4
AUERBACH PUBLICATIONS
www.auerbach-publications.com
To Order Call: 1-800-272-7737 • Fax: [phone]
E-mail: [email protected]
Network Attacks
and Defenses
A Hands-on Approach
Zouheir Trabelsi • Kadhim Hayawi
Arwa Al Braiki • Sujith Samuel Mathew
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2013 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20120827
International Standard Book Number-13: 978-1-4665-1797-4 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.

For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a pho-
tocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Introduction................................................................xxv
 1  Switch’s.CAM.Table.Poisoning.Attack......................1
1.1 Introduction ..............................................................1
1.2 Lab Exercise 1.1: Switch’s CAM Table Poisoning .....3
1.2.1 Outcome ......................................................3
1.2.2 Description ...................................................3
1.2.3 Experiment ...................................................5
1.2.3.1 Step 1: Assign Static IP
Addresses to the Network
Hosts ..........................................5
1.2.3.2 Step 2: View the Contents
of the CAM Table ......................6
1.2.3.3 Step 3: Generate a Malicious
Packet to Corrupt the CAM
Table ..........................................8
1.2.3.4 MAC Flood Attack for

Traffic Sniffing ...........................9
1.3 Lab Exercise 1.2: Prevention of CAM Table
Poisoning Attack ......................................................10
1.3.1 Outcome .....................................................10
1.3.2 Description ..................................................10
1.3.3 Experiment ..................................................11
1.3.3.1 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................11
v
vi  ◾  Contents
1.3.3.2 Step 2: Configure the
Restrict Mode Security Port
in the Switch ............................11
1.3.3.3 Step 3: Generate a Malicious
Packet to Corrupt the CAM
Table .........................................12
1.3.3.4 Step 4: Configure the
Shutdown Mode Security
Port in the Switch .....................14
1.4 Chapter Summary ....................................................15
 2  ARP.Cache.Poisoning-Based.MiM.
and DoS Attacks.....................................................17
2.1 Introduction .............................................................17
2.1.1 Address Resolution Protocol (ARP) ............17
2.1.2 ARP Cache ..................................................18
2.2 Lab 2.1: ARP Cache Poisoning Attack .....................20
2.2.1 Outcome .....................................................20
2.2.2 Description ..................................................20
2.2.3 Static ARP Cache Update............................21
2.2.4 Experiment ..................................................25
2.2.4.1 Network Architecture ...............25
2.2.4.2 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................26
2.2.4.3 Step 2: View the ARP
Caches of the Hosts .................26

2.2.4.4 Build a Malicious ARP
Request Packet to Corrupt a
Target Host’s ARP Cache .........26
2.3 Lab 2.2: DoS Attack Based on ARP Cache
Poisoning ................................................................28
2.3.1 Outcome ....................................................28
2.3.2 DoS Attack Based on ARP Cache
Poisoning ...................................................28
Contents  ◾  vii
2.3.3 Experiment ..................................................30
2.3.3.1 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................30
2.3.3.2 Step 2: View Host A’s ARP
Cache ........................................30
2.3.3.3 Step 3: Build the
Malicious ARP Request Packet 31
2.3.3.4 Step 4: Test the DoS Attack ......32
2.4 Lab 2.3: MiM Attack Based on ARP Cache
Poisoning .................................................................33
2.4.1 Outcome .....................................................33
2.4.2 MiM Attack Based on ARP Cache
Poisoning ....................................................33
2.4.3 Experiment ..................................................36
2.4.3.1 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................37
2.4.3.2 Step 2: Enable IP Routing at
Host C .......................................37
2.4.3.3 Step 3: View the ARP
Caches of Host A and Host B ..39
2.4.3.4 Step 4: Build Two Malicious
ARP Request Packets ...............39
2.4.3.5 Step 5: Test the MiM Attack .....41
2.4.3.6 Step 6: Sniff and Analyze
the Traffic between Hosts A
and B ........................................41
2.5 Chapter Summary ...................................................44
 3  Abnormal.ARP.Traffic.Detection.and.Prevention.....45
3.1 Introduction .............................................................45
3.2 Abnormal ARP Packets ........................................... 46
3.3 Experiments .............................................................51
3.3.1 Cross-Layers ARP Inspection .....................55
3.3.2 ARP Stateful Inspection ..............................55
viii  ◾  Contents
3.3.3 ARP Request Storm and ARP Scan ............56
3.3.3.1 ARP Request Storm ..................56
3.3.3.2 ARP Scan ..................................56
3.3.4 Experimental Results Analysis ...................57
3.4 Lab 3.1: Abnormal ARP Traffic Detection ...............58
3.4.1 Outcome .....................................................58
3.4.2 XArp 2 Detection Tool ...............................58
3.4.3 Experiment ..................................................59
3.4.3.1 Network Architecture ...............59
3.4.3.2 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................60
3.4.3.3 Step 2: Install the XArp 2
Tool ..........................................60
3.4.3.4 Step 3: Configure a SPAN
Port in the Cisco Switch ...........61
3.4.3.5 Step 4: Generate and Detect
Abnormal ARP Packets ............61
3.5 Lab 3.2: Abnormal ARP Traffic Prevention
Using Dynamic ARP Inspection for a
Non-DHCP Network Environment ..........................69
3.5.1 Outcome .....................................................69
3.5.2 Dynamic ARP Inspection ...........................69
3.5.3 Experiment ..................................................70
3.5.3.1 Network Architecture ...............70
3.5.3.2 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .........................................71
3.5.3.3 Step 2: Configure Dynamic
ARP Inspection for a Non-
DHCP Environment in a
Cisco Catalyst 3560 Switch .......71
3.5.3.4 Step 3: Generate and
Prevent Abnormal ARP
Packets ......................................74
Contents  ◾  ix
3.6 Lab 3.3: Abnormal ARP Traffic Prevention
Using Dynamic ARP Inspection and DHCP
Snooping for a DHCP Environment ........................82
3.6.1 Outcome .....................................................82
3.6.2 DHCP Snooping ..........................................82
3.6.3 Experiment ..................................................83
3.6.3.1 Network Architecture ...............83
3.6.3.2 Step 1: Enable DHCP
Snooping .................................84
3.6.3.3 Step 2: Configure Dynamic
ARP Inspection for a DHCP
Environment .............................85
3.6.3.4 Step 3: Generate and Prevent
Abnormal ARP Packet .............86
3.7 Chapter Summary ...................................................88
 4  Network.Traffic.Sniffing.and.Promiscuous.
Mode.Detection.......................................................89
4.1 Introduction .............................................................89
4.2 Lab 4.1: Promiscuous Mode Detection ...................94
4.2.1 Outcome .....................................................94
4.2.2 Description ..................................................94
4.2.3 Tests ............................................................95
4.2.4 Promiscuous Mode Detection Tools ........101
4.2.5 Experiment ................................................103
4.2.6 Network Architecture ...............................103
4.2.7 Experiment ................................................103

4.2.7.1 Step 1: Assign Static IP
Addresses to the Network’s
Hosts .......................................103
4.2.7.2 Step 2: Run Host B’s NIC in
Promiscuous Mode ................104
4.2.7.3 Step 3: Generate Trap ARP
Request Packets ......................104
4.2.7.4 Step 4: Analyze the ARP
Response Packets ...................106
x  ◾  Contents
4.2.8 Wireless Network Sniffing ........................110
4.2.8.1 WEP Key Cracking and
Network Traffic Decryption ...111
4.3 Chapter Summary ..................................................116
 5  IP-Based.Denial-of-Service.Attacks......................117
5.1 Introduction ...........................................................117
5.1.1 Distributed Denial-of-Service (DDoS)
Attack ........................................................118
5.2 Lab 5.1: Land Attack ..............................................120
5.2.1 Outcome ...................................................120
5.2.2 Description ................................................120
5.2.3 Experiment ................................................120
5.2.3.1 Step 1: Configure the
Network Interfaces in the
Juniper Networks Device .......121
5.2.3.2 Step 2: Set the Security
Policies (Filtering Rules) .........122
5.2.3.3 Step 3: Enable Protection
against the Land Attack .........122
5.2.3.4 Step 4: Build Land Attack
Packets ....................................123
5.2.3.5 Step 5: Sniff the Generated
Traffic ......................................124
5.2.3.6 Step 6: View Results in
the Log File of the Juniper
Networks Device ....................125

5.3 Lab 5.2: SYN Flood Attack ....................................126
5.3.1 Outcome ...................................................126
5.3.2 Description ................................................126
5.3.3 Experiment ................................................127
5.3.3.1 Step 3: Enable Protection
against the SYN Flood Attack 128
5.3.3.2 Step 4: Build SYN Flood
Attack Packets ........................128