DoS/DDoS Session Hijacking SQL Injection Attacks

DoS/DDoS
Session Hijacking
SQL Injection Attacks
 Introduction to DoS DDoS

Introduction to DoS & DDoS

Denial of Service (DoS)
A cyberattack designed to disrupt the availability of a system, network, or application.
The attacker uses a single machine or source to overwhelm the target.

Distributed Denial of Service (DDoS)

A more advanced version where multiple machines (often globally distributed) are used.
These machines are usually part of a botnet, making the attack harder to detect and block.

Key Idea
The core principle is resource exhaustion:
• Bandwidth exhaustion - network becomes congested
• CPU exhaustion - server cannot process requests
• Memory exhaustion - system crashes or hangs
The attacker does NOT necessarily break into the system - they simply make it unusable for
legitimate users.

Real-World Analogy
A hospital emergency room
• Suddenly flooded with thousands of fake patients
• Doctors and nurses are overwhelmed
• Real patients (legitimate users) cannot get help
DoS/DDoS targets Availability in the CIA Triad (Confidentiality, Integrity, Availability)
Types of DoS Attacks

Types of DoS Attacks

1. Volume-Based Attacks
Aim to consume all available bandwidth
Measured in bits per second (bps)

Examples
a. UDP Flood - Sends large numbers of UDP packets to random ports
b. ICMP Flood (Ping Flood) - Overloads target using echo requests

Effect
Network becomes saturated
Legitimate traffic cannot pass through

2. Protocol Attacks
Exploit weaknesses in network protocols (Layer 3 & 4)

Examples
SYN Flood - Ping of Death , Smurf Attack

Effect
Exhaust server connection tables
Consume network infrastructure resources (firewalls, load balancers)
 Types of DoS Attacks
3. Application Layer Attacks
Target specific applications (Layer 7)

Examples
HTTP GET/POST Flood
Slowloris attack

Effect
Harder to detect because traffic looks legitimate
Requires fewer resources but causes maximum damage

Type Target Detection Difficulty

Volume Bandwidth Easy
Protocol Network stack Medium
Application Web apps Hard
 SYN Flood Attack
Normal TCP Handshake
Step 1: Client → SYN
Step 2: Server → SYN-ACK
Step 3: Client → ACK
Connection established

Attack Behavior
Attacker sends massive SYN requests
Uses:
• Fake IP addresses (spoofing)
• Server replies with SYN-ACK
• Attacker never responds with ACK

What Happens Internally

Server keeps half-open connections
Connection queue fills up
No space for legitimate users

Impact
Server becomes:
• Slow
• Unresponsive
• Eventually crashes
 What is a Botnet?

What is a Botnet?

A collection of compromised devices (computers, phones, IoT devices)

Controlled remotely by an attacker

Key Components
• Bots (Zombies)
Infected devices
Execute attack commands
• Command & Control (C2) Server
Central system controlling bots
Sends instructions

How Devices Get Infected

• Malware downloads
• Phishing attacks
• Vulnerable services

Real-World Insight
IoT devices (cameras, routers) are commonly used
Example botnet: Mirai

Botnets enable massive scale attacks without needing powerful hardware

DDoS Attack Flow

DDoS Attack Flow

Step-by-Step Flow
• Attacker creates/distributes malware
• Devices become bots
• Bots connect to C2 server
• Attacker sends attack command
• All bots simultaneously: Send traffic to victim

Why It’s Powerful

Traffic comes from:
1. Different IPs
2. Different countries
Makes blocking difficult

Outcome
Service becomes: Slow , Unavailable or Completely offline
 Tools Used in DoS/DDoS

Tools Used in DoS/DDoS

Strictly for ethical lab simulations

Attack Tools
1. LOIC (Low Orbit Ion Cannon)
Simple interface
Generates TCP/UDP/HTTP traffic
2. HOIC
More powerful than LOIC
Supports multiple targets
3. hping3
Advanced packet crafting tool
Used for SYN floods and custom attacks

Traffic Analysis Tools

1. Wireshark
Packet-level analysis
Detect abnormal traffic patterns

2. NetFlow Analyzers
Monitor traffic flow statistics
 Demonstration Concept DOS/DDOS

Demonstration Concept DOS/DDOS

Controlled lab environment

Target: Local test server

Simulation Steps (Conceptual)

• Configure target IP
• Select attack type:
TCP flood
UDP flood
HTTP flood
• Initiate traffic

Expected
CPU usage increases
Network traffic spikes
Server response slows

Outcome
Understand real impact of attacks
Visualize resource exhaustion
 Detecting DoS/DDoS Attacks

Detecting DoS/DDoS Attacks

Key Indicators
1. Sudden traffic spikes
2. High number of requests per second
3. Repeated requests from similar patterns

Advanced Indicators
1. Large number of half-open connections
2. Abnormal geographic traffic distribution
3. Unexpected protocol usage

Monitoring Tools
Network monitoring systems
IDS/IPS alerts

Detection requires baseline knowledge of normal traffic

Defensive Countermeasures for DoS/DDoS

Defensive Countermeasures for DoS/DDoS

Network-Level Defenses
1. Firewalls - Filter malicious traffic
2. IDS/IPS - Detect and block attacks
3. Rate limiting - Limit requests per IP

Application-Level Defenses
CAPTCHA - Prevent bots
Load balancing - Distribute traffic across servers

Advanced Protection
Cloud-based DDoS protection:
Traffic filtering before reaching server

Best Practices
Regular updates
Network segmentation
Traffic monitoring

Defense is about: Prevention , Detection , Response

 Session Hijacking

Session Hijacking
Session Hijacking is an attack where an attacker takes control of an already
authenticated session between a user and a system.
Instead of breaking passwords, the attacker: steals or predicts the session identity

Key Target: Session ID

A Session ID is a unique identifier assigned after login
It is stored in: Cookies , URLs (in insecure systems) , Hidden form fields
It acts like a temporary password

Why It’s Dangerous

No need to:
• Crack passwords
• Bypass authentication
• Attacker directly impersonates the user

Real-World Analogy
Logging into a system = getting a VIP access badge
Session hijacking = someone steals your badge and walks in as you

This attack targets Authentication & Session Management, not login credentials
directly
How Sessions Work

How Sessions Work

Step-by-Step Process
• User enters credentials (username/password)
• Server verifies credentials
• Server generates a Session ID
• Session ID is sent to the browser
• Browser stores it (usually as a cookie)

For every request:

1. Browser sends session ID
2. Server uses it to identify the user
Important Concept - The server trusts the Session ID, not the user again

Where Sessions Can Be Stored -Cookies (most common) , Local storage (less secure) ,
URL parameters (very insecure)

Attack Insight
If an attacker gets the Session ID:
They don’t need login details
They instantly gain authenticated access

Summary Explanation
User → Login → Server → Session ID → Browser
Browser → Requests + Session ID → Server → Access granted
 Types of Session Hijacking

Types of Session Hijacking

1. Network-Level Hijacking
Occurs during data transmission over a network
Attacker intercepts traffic

Techniques - Packet Sniffing , Man-in-the-Middle (MITM)

2. Application-Level Hijacking
Exploits web application vulnerabilities

Techniques- Cross-Site Scripting (XSS) , Session Fixation

Where it
Type Difficulty Example
Happens
Network-Level Network traffic Medium Wi-Fi sniffing
Application-Level Web application High XSS attacks

Application-level attacks are more dangerous because they: Work even on encrypted
connections (if poorly implemented)
 Network-Level Hijacking

Network-Level Hijacking
1. Technique: Packet Sniffing
Capturing data packets traveling across a network

How It Works
Attacker connects to the same network (e.g., Wi-Fi)
• Uses sniffing tools
• Captures unencrypted traffic
• Extracts session cookies

Tools (Lab Use)

[Link] - Captures packets . Allows deep inspection
2. Ettercap - Performs sniffing + MITM attacks

Scenario
User logs into a website using HTTP (not HTTPS)
Session cookie is sent in plain text
Attacker captures: Session ID

Impact
• Attacker uses stolen cookie
• Gains full access to user account
This is why unencrypted networks are dangerous
 Man-in-the-Middle (MITM) Attack

Man-in-the-Middle (MITM) Attack

Attacker secretly intercepts communication between:
Client (user)
Server

Communication Flow
User Attacker Server

How It Works
• Attacker positions themselves in the network
• Intercepts traffic
Can: Read data , Modify data , Inject malicious content

Common MITM Techniques

ARP Spoofing , DNS Spoofing , Rogue Wi-Fi hotspots

Impact
• Steal session cookies
• Capture login credentials
• Manipulate communication

MITM attacks break confidentiality and integrity

 Application-Level Hijacking

Application-Level Hijacking
1. Cross-Site Scripting (XSS) - Inject malicious JavaScript into a web page

How It Works
• Attacker injects script into vulnerable input field
• Script executes in victim’s browser
• Script sends session cookie to attacker

Impact - Attacker steals session ID , Gains unauthorized access

2. Session Fixation - Attacker sets or predicts a session ID before login

How It Works
• Attacker creates a session ID
• Tricks victim into using it (via link/email)
• Victim logs in
• Session becomes authenticated
• Attacker uses same session ID

Impact- Full account takeover without stealing cookies

These attacks exploit poor session management

 Prevention Techniques

Prevention Techniques
1. Encryption (Critical Defense)
Use HTTPS (SSL/TLS)- Encrypts communication , Prevents packet sniffing

2. Session Security Controls

Secure Cookies- Secure flag - only sent over HTTPS , HttpOnly- prevents JavaScript
access

Session Timeout- Automatically logs out inactive users , Reduces attack window

Session Regeneration - Generate new session ID after login , Prevent session fixation

3. Application Security
Input Validation - Prevent malicious scripts
XSS Protection - Escape user inputs , Use security headers

4. Network Security- Avoid public Wi-Fi , Use VPNs

5. Advanced Controls - Multi-Factor Authentication (MFA) , Intrusion Detection

Systems

Strong security = combination of: Encryption , Secure coding , User awareness

 SQL Injection

SQL Injection
SQL Injection (SQLi) is a vulnerability where an attacker injects malicious SQL code
into application inputs (e.g., login forms, search boxes).
This happens when:User input is not properly validated or sanitized before being used
in SQL queries.

Goal of SQL Injection

1. Access sensitive data (usernames, passwords, financial records)
2. Modify or delete data
3. Bypass authentication
4. Execute administrative database operations

Why It Happens
Developers directly include user input in SQL queries:

This creates a trust problem - the system trusts user input.

Real-World Analogy
A receptionist asks your name and writes it directly into a system
Instead of a name, you give: “Admin OR allow all access”
System blindly accepts it - grants full access
• SQL Injection targets data layer (database) - the “brain” of the application
 How SQL Injection Works

How SQL Injection Works

Normal Query Execution

Expected behavior: Returns user only if credentials match

Injected Input (Attack)

Modified Query (What the Server Sees)

Why It Works
'1'='1' is always TRUE
SQL evaluates condition: TRUE - returns all records

Result- Authentication bypassed , Attacker logs in without valid credentials

SQL Injection manipulates logic of the query, not just input

Even a simple input field can control entire database behavior
 Types of SQL Injection

Types of SQL Injection

1. In-Band SQL Injection (Most Common)
•Attacker uses the same communication channel to send payload and receive results

a) Error-Based SQLi
•Relies on database error messages
Example:
•Inject invalid query - database returns error
•Error reveals:
• Table names
• Column names

b) Union-Based SQLi
•Uses UNION to combine queries
Example: SELECT username, password FROM users

UNION
SELECT credit_card, expiry FROM payments;
Extracts data from another table
Types of SQL Injection

Types of SQL Injection

2. Blind SQL Injection
•No direct output - attacker infers results

a) Boolean-Based Blind SQLi - Sends TRUE/FALSE conditions

Example:' AND 1=1 -- ' AND 1=2 --
Observes: Page response difference

b) Time-Based Blind SQLi - Uses delays to infer results

Example: ' AND SLEEP(5) --
If delay occurs - condition is TRUE

3. Out-of-Band SQL Injection

Data is retrieved using external channels
Example: DNS requests , HTTP callbacks

Blind SQLi shows: Even when errors are hidden, systems can still be exploited
 SQL Injection Methodology

SQL Injection Methodology

Step 1: Identify Input Fields - Login forms , Search boxes , URL parameters

Step 2: Test for Vulnerability - Try basic payloads:

' OR 1=1 --
' AND 1=2 --
Observe behavior changes

Step 3: Determine Database Structure- Find: Number of columns , Table names

Column names

Step 4: Extract Data- Use UNION queries or automated tools

Retrieve: Credentials , Sensitive records

Step 5: Exploit Further- Modify data , Delete tables , Escalate privileges

Teaching Insight - SQLi is a step-by-step attack, not random guessing

 Tools for SQL Injection

Tools for SQL Injection

Strictly for ethical and lab use only

1. SQLmap
• Fully automated SQL injection tool
• Detects vulnerabilities
• Extracts database data

Features:Database fingerprinting , Password dumping , Table enumeration

2. Burp Suite
Web security testing tool
Intercepts HTTP requests

Used for:Modifying inputs , Testing payloads manually

3. OWASP ZAP
Open-source web vulnerability scanner
Automated + manual testing

Tools make attacks easier, but understanding the logic is critical

 Impact of SQL Injection

Impact of SQL Injection

1. Data Theft- User credentials , Financial records , Confidential business data

2. Unauthorized Access- Login as admin , Privilege escalation

3. Data Manipulation- Modify records , Insert fake data

4. Database Destruction
DROP TABLE users; Permanent data loss

5. Full System Compromise

Access server
Execute OS-level commands (in advanced cases)

Real-World Impact
Data breaches
Financial losses
Reputation damage

SQLi is among the top OWASP vulnerabilities

 Defensive Techniques

Defensive Techniques
1. Input Validation
Reject malicious inputs
Use: Whitelisting (preferred) , Blacklisting (less effective)

2. Prepared Statements (Best Defense)

Separate SQL logic from data
SELECT * FROM users WHERE username=? AND password=?
Prevents query manipulation

3. Stored Procedures - Predefined queries in database , Limit dynamic SQL

execution

4. Least Privilege Principle - Database users have minimal access , Prevents major
damage if compromised

5. Web Application Firewall (WAF) - Detects and blocks SQLi patterns

6. Error Handling - Do not display database errors to users

7. Security Testing - Regular penetration testing , Code reviews

Prevention = secure coding + layered defenses

 Recap Questions
1. Explain the difference between DoS and DDoS attacks.
2. What is a SYN Flood attack and why does it affect the
server?
3. What is a botnet and how is it used in DDoS attacks?
4. Explain how session hijacking works and why it is
dangerous.
5. Differentiate between network-level and application-
level session hijacking.
6. What is SQL Injection and how can it be prevented?
Thank you!

Thank you!

Any Questions?