网络协议攻击-01-传输层协议攻击

传输层协议攻击

前言

传输层的主要协议是TCP、UDP。

流行的攻击方式:

  1. TCP RST攻击
  2. TCP会话劫持攻击
  3. TCP SYN洪泛拒绝服务攻击

TCP RST 攻击

又称伪造TCP重置报文攻击,假冒干扰TCP通信连接的技术方法。

在TCP协议头的标志位中拥有一个“reset”比特位,绝大部分数据包中该标志位都置为0,而一旦该标志为置为1,则接收该数据包的主机将立即断开这个TCP会话连接,不再利用该连接进行数据包发送和接收。

危害:

当恶意攻击者滥用TCP重置报文,就会对正常的网络通信造成严重。

img

如上图所示:

在TCP RST攻击中,攻击者Eve可以通过嗅探方式监视Alice和Bob之间的TCP连接,在获得源、目标IP地址及端口,以及序列号之后,就可以结合IP源地址欺骗技术伪装成通信一方(也就是伪装成Alice)发送TCP重置报文给Bob,在确保端口号一致及序列号落入TCP窗口之内的情况下,即可直接关闭这个TCP连接,造成通信双方正常网络通信的中断,从而达到拒绝服务的效果。

  • 4
    点赞
  • 18
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
What’s in This Book? This book contains a mix of theoretical and practical chapters. For the practical chapters, I’ve developed and made available a networking library called Canape Core, which you can use to build your own tools for protocol analysis and exploitation. I’ve also provided an example networked application called SuperFunkyChat, which implements a userto-user chat protocol. By following the discussions in the chapters, you can use the example application to learn the skills of protocol analysis and attack the sample network protocols. Here is a brief breakdown of each chapter: Chapter 1: The Basics of Networking This chapter describes the basics of computer networking with a particular focus on TCP/IP, which forms the basis of application-level network protocols. Subsequent chapters assume that you have a good grasp of the network basics. This chapter also introduces the approach I use to model application protocols. The model breaks down the application protocol into flexible layers and abstracts complex technical detail, allowing you to focus on the bespoke parts of the protocol you’re analyzing. Chapter 2: Capturing Application Traffic This chapter introduces the concepts of passive and active capture of network traffic, and it’s the first chapter to use the Canape Core network libraries for practical tasks. Chapter 3: Network Protocol Structures Download from finelybook www.finelybook.com 24This chapter contains details of the internal structures that are common across network protocols, such as the representation of numbers or human-readable text. When you’re analyzing captured network traffic, you can use this knowledge to quickly identify common structures, speeding up your analysis. Chapter 4: Advanced Application Traffic Capture This chapter explores a number of more advanced capture techniques that complement the examples in Chapter 2. The advanced capture techniques include configuring Network Address Translation to redirect traffic of interest and spoofing the address resolution protocol. Chapter 5: Analysis from the Wire This chapter introduces methods for analyzing captured network traffic using the passive and active techniques described in Chapter 2. In this chapter, we begin using the SuperFunkyChat application to generate example traffic. Chapter 6: Application Reverse Engineering This chapter describes techniques for reverse engineering networkconnected programs. Reverse engineering allows you to analyze a protocol without needing to capture example traffic. These methods also help to identify how custom encryption or obfuscation is implemented so you can better analyze traffic you’ve captured. Chapter 7: Network Protocol Security This chapter provides background information on techniques and cryptographic algorithms used to secure network protocols. Protecting the contents of network traffic from disclosure or tampering as it travels over public networks is of the utmost importance for network protocol security. Chapter 8: Implementing the Network Protocol This chapter explains techniques for implementing the application Download from finelybook www.finelybook.com 25network protocol in your own code so you can test the protocol’s behavior to find security weaknesses. Chapter 9: The Root Causes of Vulnerabilities This chapter describes common security vulnerabilities you’ll encounter in a network protocol. When you understand the root causes of vulnerabilities, you can more easily identify them during analysis. Chapter 10: Finding and Exploiting Security Vulnerabilities This chapter describes processes for finding security vulnerabilities based on the root causes in Chapter 9 and demonstrates a number of ways of exploiting them, including developing your own shell code and bypassing exploit mitigations through return-oriented programming. Appendix: Network Protocol Analysis Toolkit In the appendix, you’ll find descriptions of some of the tools I commonly use when performing network protocol analysis. Many of the tools are described briefly in the main body of the text as well. How to Use This Book If you want to start with a refresher on the basics of networking, read Chapter 1 first. When you’re familiar with the basics, proceed to Chapters 2, 3, and 5 for practical experience in capturing network traffic and learning the network protocol analysis process. With the knowledge of the principles of network traffic capture and analysis, you can then move on to Chapters 7 through 10 for practical information on how to find and exploit security vulnerabilities in these protocols. Chapters 4 and 6 contain more advanced information about additional capture techniques and application reverse engineering, so you can read them after you’ve read the other chapters if you prefer. For the practical examples, you’ll need to install .NET Core Download from finelybook www.finelybook.com 26(https://www.microsoft.com/net/core/), which is a cross-platform version of the .NET runtime from Microsoft that works on Windows, Linux, and macOS. You can then download releases for Canape Core from https://github.com/tyranid/CANAPE.Core/releases/ and SuperFunkyChat from https://github.com/tyranid/ExampleChatApplication/releases/; both use .NET Core as the runtime. Links to each site are available with the book’s resources at https://www.nostarch.com/networkprotocols/. To execute the example Canape Core scripts, you’ll need to use the CANAPE.Cli application, which will be in the release package downloaded from the Canape Core Github repository. Execute the script with the following command line, replacing script.csx with the name of the script you want to execute.

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

AnQ_xiao

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值