2.2 (5,6,7,8,14,16)

6. ⁠ Explain protocol susceptible to sniffing

sniffing, also known as network sniffing,packet sniffing or packet analysis, is the practice of capturing and inspecting data packets as they pass through a network

1. Definition: Packet sniffing involves intercepting and examining the data packets traveling across a network. This can be done using specialized software or hardware called sniffers.

1. Functionality: Sniffer tools capture network traffic and display it either in a command-line interface (CLI) or graphical user interface (GUI). Some advanced sniffers can interpret the packets and reconstruct the original data, such as emails or documents.

2. Purpose: Sniffers are used to capture traffic exchanged between systems on a network. They can be used by hackers to gather sensitive information transmitted over the network, including usernames, passwords, and other confidential data.

3. Operating Mode: Sniffer software operates in promiscuous mode, where it reads and captures all network traffic, not just the traffic intended for the system's MAC address. This mode allows sniffers to intercept packets destined for other devices on the network.Promiscuous mode is enabled on a network card with the installation of special driver software

4. Protocols: Sniffers are most effective against protocols that transmit data in plaintext, as they can easily capture and analyze this information. Commonly sniffed protocols include HTTP (web traffic), POP3 (email), SNMP (network management), and FTP (file transfer).

5. 5. Promiscuous mode is a feature of network interface cards (NICs) that allows them to capture and inspect all network traffic that they can see, regardless of whether it is intended for them or not. In normal operation, a network card only accepts packets addressed specifically to its own MAC address, discarding all others. However, when a network card is placed in promiscuous mode, it will accept and process all packets it sees, regardless of the destination MAC address.This mode is particularly useful for packet sniffing because it enables a network analyzer or packet sniffer to capture and analyze all traffic on a network segment,

5. ⁠ What are DNS spoofing technique?

DNS spoofing, also known as DNS poisoning, is a type of cyber attack that involves manipulating the Domain Name System (DNS) to redirect users to malicious or fake websites. The DNS is responsible for translating human-readable domain names (e.g., www.example.com) into machine-readable IP addresses (e.g., 192.0.2.1) to facilitate communication over the Internet.

In DNS spoofing attacks, attackers exploit vulnerabilities in the DNS infrastructure to inject false DNS records into DNS caches. These false records associate legitimate domain names with incorrect IP addresses, leading users to unintended destinations when attempting to access those domains.

1. Injection of False DNS Records: Attackers send forged DNS responses to DNS servers, containing incorrect mappings between domain names and IP addresses. These forged responses are then cached by DNS servers and distributed to other systems querying the DNS.

2. Redirecting Traffic: When users attempt to access a legitimate website whose DNS records have been spoofed, their systems receive the false DNS information from the compromised DNS server. As a result, their web browsers are directed to the IP address specified in the spoofed records, which may lead to a malicious website controlled by the attacker.

3. Phishing and Malware Distribution: Attackers often use DNS spoofing to redirect users to fake versions of legitimate websites, where they can launch phishing attacks to steal sensitive information such as login credentials, financial details, or personal data. Additionally, malicious websites may distribute malware or engage in other nefarious activities.

4. Cache Poisoning: In some cases, attackers exploit vulnerabilities in DNS caching mechanisms to poison the DNS cache of a recursive DNS server. This allows them to persistently redirect traffic for specific domain names until the cache is cleared or updated

Here's an overview of DNS spoofing techniques:

1. **Intranet Spoofing**: In this technique, the attacker operates within the same internal network as the victim. By spoofing DNS responses, the attacker can redirect internal network traffic to malicious servers or websites controlled by them.

2. **Internet Spoofing**: In contrast to intranet spoofing, internet spoofing involves the attacker operating from outside the victim's network, typically over the internet. The attacker sends spoofed DNS responses to the victim's DNS server, leading to the redirection of traffic to malicious destinations.

3. **Proxy Server DNS Poisoning**: Proxy servers act as intermediaries between clients and servers. In this technique, the attacker compromises a proxy server and manipulates its DNS cache. By poisoning the DNS entries on the proxy server, the attacker can redirect users to malicious destinations when they attempt to access specific websites through the proxy.

4. **DNS Cache Poisoning**: DNS cache poisoning involves manipulating the DNS cache of any system, including DNS servers or even individual client machines. By injecting fake DNS records into the cache, the attacker can redirect users to fraudulent websites or servers when they attempt to access legitimate ones.

• DNSSEC (Domain Name System Security Extensions): Implement DNSSEC to authenticate DNS responses and prevent DNS spoofing attacks by ensuring the integrity and authenticity of DNS data.
• DNS Caching: Regularly flush DNS caches to prevent the persistence of spoofed DNS records and reduce the impact of DNS cache poisoning attacks.
• DNS Filtering: Use DNS filtering services or firewalls to block access to known malicious domains and prevent users from accessing spoofed websites.

16 ⁠Explain sniffing countermeasures.

To defend against sniffing attacks and mitigate the risk of sensitive information being intercepted on a network, several countermeasures can be implemented:

1. Encryption: Implementing encryption protocols such as SSL/TLS for web traffic, IPsec for network communications, and encrypted VPNs for remote access can prevent sniffers from intercepting and deciphering sensitive data.

2. Use of Secure Protocols: Employing secure protocols, such as HTTPS for web browsing, SSH for remote access, and SFTP/SCP for file transfers, ensures that data transmitted over the network is protected from eavesdropping.

3. Network Segmentation: Segmenting the network into separate subnets with firewalls and access controls can restrict the ability of sniffers to capture traffic beyond their designated segments.

4. Promiscuous Mode Detection: Implementing intrusion detection systems (IDS) or network monitoring tools to detect and alert administrators to the presence of devices operating in promiscuous mode, which may indicate unauthorized sniffing activity.

5. Packet Filtering: Configuring network devices, such as routers and firewalls, to filter and discard suspicious or unauthorized packets can prevent sniffers from capturing sensitive data.

6. Port Security: Enabling port security features, such as MAC address filtering and port lockdown, on switches and network devices can prevent unauthorized devices from connecting to the network and launching sniffing attacks.

7. Network Monitoring: Regularly monitoring network traffic and analyzing network logs for signs of suspicious activity can help detect and mitigate sniffing attacks in real-time.

8. Strong Authentication: Implementing strong authentication mechanisms, such as multi-factor authentication (MFA) and certificate-based authentication, helps prevent unauthorized access to network resources and reduces the risk of sniffing attacks.

9. Employee Training: Educating employees about the risks of sniffing attacks and the importance of practicing good security hygiene, such as avoiding insecure protocols and using secure communication channels, can help mitigate the human factor in network security breaches.

2. 7. What is ARP spoofing? Explain in detail.
3. ARP spoofing, also known as ARP poisoning, is a cyber attack technique used to intercept, modify, or redirect network traffic
4. ARP (Address Resolution Protocol) is a protocol used to map IP addresses to physical MAC addresses on a local area network (LAN)
5. When one host using TCP/IP on a LAN tries to contact another, it needs the MAC address or hardware address of the host it’s trying to reach. It first looks in its ARP cache to see if it already has the MAC address; if it doesn’t, it broadcasts an ARP request asking, “Who has the IP address I’m looking for?” If the host that has that IP address hears the ARP query, it responds with its own MAC address, and a conversation can begin using TCP/IP. 
7. ARP poisoning utilizes ARP spoofing where the purpose is to send fake, or spoofed, ARP messages to an Ethernet LAN. These frames contain false MAC addresses that confuse network devices such 
8. as network switches.
9. an attacker sniff data frames on a switched LAN or stop the traffic altogether. 
10. By sending spoofed ARP messages, the attacker can associate their MAC address with the IP address of the gateway or other critical network devices. This allows the attacker to intercept, modify, or block network traffic intended for those devices.
11. ARP poisoning can lead to data interception, session hijacking, or network disruption, depending on the attacker's objectives.
12. This allows attackers to eavesdrop on communications, steal sensitive data, or launch man-in-the-middle attacks
13. ARP spoofing attacks can be used for various malicious purposes, including network sniffing, session hijacking, data theft, and network reconnaissance.

Prevention:

• Static ARP Entries: Administrators can manually configure static ARP entries on devices to ensure that only legitimate MAC-to-IP mappings are accepted. However, this approach can be impractical to manage in large networks.
• Port-Based Security: Network switches can be configured with port-based security features to restrict the number of MAC addresses allowed on each switch port. This helps mitigate the risk of ARP spoofing by limiting the number of devices that can connect to each port.
• ARP Spoofing Detection: Intrusion detection systems (IDS) or network monitoring tools can be deployed to detect anomalous ARP behavior, such as multiple devices claiming the same IP address or frequent changes in MAC-to-IP mappings.

8. ⁠ Write short note on MAC flooding

MAC flooding, also known as MAC address flooding or MAC table overflow attack, is a technique used to compromise the security of network switches. Let’s dive into the details:

1. How Switches Work:
   • Network switches maintain a MAC address table that maps individual MAC addresses (unique identifiers for network devices) to the physical ports on the switch.
   • This table allows the switch to direct data specifically to the port where the recipient device is located, rather than broadcasting it to all ports (as an Ethernet hub does).
2. The MAC Flooding Attack:
• The attacker floods the switch with many Ethernet frames, each containing a different source MAC address.
• The goal is to consume the limited memory set aside in the switch for storing MAC address information.
• As a result, legitimate MAC addresses are forced out of the MAC address table.
• The switch then behaves as if it were an Ethernet hub, broadcasting incoming frames out on all ports.
• This unicast flooding behavior gives the attack its name: MAC flooding.
3. Impact and Objectives:
• After a successful MAC flooding attack:
• A malicious user can use a packet analyzer to capture sensitive data transmitted between other computers on the network.
• This data would not be accessible under normal switch operation.
• The attacker may follow up with an ARP spoofing attack to retain access to privileged data even after switches recover from the initial MAC flooding.
4. Network administrators can implement port security features, such as limiting MAC addresses per port or enabling MAC address aging. Intrusion detection and prevention systems (IDPS) can also help detect and respond to MAC flooding attacks.
5. The objective of a MAC flooding attack may vary. In some cases, it's used to disrupt network operations or cause a DoS condition. In other cases, it's employed as a precursor to other attacks, such as ARP poisoning or sniffing attacks, where the attacker aims to intercept or manipulate network traffic

14. What is spoofing? Give its types.

Spoofing is a technique used in computer networking to deceive or trick systems, devices, or users by falsifying information. It involves manipulating data packets or communication protocols to impersonate another entity or hide one's true identity. The goal of spoofing attacks can vary, including gaining unauthorized access, bypassing security measures, or launching other malicious activities.

DNS Spoofing

ARP Poisoning