1.
Buffer Overflow Attacks
• Definition: Occurs when a program writes more data to a buffer than it can hold,
overwriting adjacent memory.
• Impact: Attackers can inject malicious code and execute it.
• Example:
o A program expects 20 characters for a username. If attacker inputs 100
characters, extra data may overwrite the program’s execution path.
o Famous Case: Morris Worm (1988) used buffer overflow in finger service.
Diagram
Memory Layout:
-------------------------
| Buffer (20 bytes) |
| Data: "AAAAAAAA..." |
-------------------------
| Adjacent memory | <-- Overwritten
| Return Address | <-- Changed to attacker code
-------------------------
• Effect: Attacker overwrites return address → Executes malicious code.
Buffer Overflow (Secure Coding & Observation)
Goal: Show how unsafe functions cause memory corruption; fix it with safe code.
Setup:
1. On a Linux VM: sudo apt install build-essential gdb
2. Create unsafe C program:
// demo_unsafe.c (for demonstration only)
#include <stdio.h>
#include <string.h>
int main() {
char buf[16];
printf("Enter name: ");
gets(buf); // intentionally unsafe
printf("Hello %s\n", buf);
return 0;
3. Compile: gcc -fno-stack-protector -z execstack -o demo_unsafe demo_unsafe.c
Observe:
• Run with very long input → notice odd behavior/crash.
• In gdb, see stack overwrite indicators (no exploit work).
Fix (secure version):
// demo_safe.c
#include <stdio.h>
int main() {
char buf[16];
printf("Enter name: ");
if (fgets(buf, sizeof(buf), stdin) != NULL) {
// strip newline safely
for (int i = 0; buf[i]; i++) if (buf[i]=='\n') buf[i]='\0';
printf("Hello %s\n", buf);
return 0;
Teach: compiler hardening flags (-fstack-protector-strong -D_FORTIFY_SOURCE=2 -O2 -Wl,-
z,relro,-z,now) and code review for dangerous APIs (gets, strcpy, sprintf).
2. Format String Vulnerabilities
• Definition: Occurs when unvalidated user input is used as a format string in
functions like printf() in C.
• Impact: Attackers can read memory, crash programs, or execute code.
• Example:
• printf(user_input);
If user_input = "%x %x %x", attacker can dump memory contents.
Format String Vulnerability
Code: printf(user_input);
Input: "%x %x %x %x"
Output: Memory values dumped
Effect: Attacker reads sensitive memory / executes injected code.
Format String (Detection & Fix)
Unsafe pattern:
// bad: printf(user_input);
printf("%s", user_input); // good — explicit format string
• Write a tiny C program that prints user input with %s.
• Show how passing format tokens no longer dumps memory.
Teach: Static analysis (cppcheck/flawfinder) to flag format bugs.
3. Denial-of-Service (DoS) Attacks
• Definition: Attackers flood a system with excessive requests, making services
unavailable.
• Example:
o Ping of Death: Sending oversized ICMP packets that crash systems.
o SYN Flood: Sending multiple SYN requests without completing handshake.
3. Denial-of-Service (DoS)
Attacker -----> [ Server ]
^^^^^^^^^^
Too many requests → Server crash/unavailable
DoS / DDoS (Rate-Limiting & Log-Based Detection)
Goal: Show how to detect and mitigate floods in your own lab server.
Setup:
• Start Nginx: sudo apt install nginx
• Enable rate limits (defense):
/etc/nginx/[Link]
http {
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
server {
location / {
limit_req zone=one burst=20 nodelay;
sudo nginx -t && sudo systemctl reload nginx
Detect:
• Watch logs: sudo tail -f /var/log/nginx/[Link]
• Traffic capture: sudo tcpdump -i any 'tcp and (dst port 80)'
Optional protections:
• fail2ban with Nginx filter, SYN cookies (sysctl -w net.ipv4.tcp_syncookies=1).
4. Hijacking Attacks
• Definition: Taking over an active session or communication channel.
• Types & Examples:
o TCP Session Hijacking: Attacker injects packets pretending to be one of the
parties.
o Example: If Alice and Bob are communicating, Eve guesses TCP sequence
numbers and injects malicious data.
TCP Session Hijacking
Alice <------> Bob (Legitimate Session)
↑
Attacker injects fake packets pretending to be Alice
Effect: Attacker takes over session.
Session Hijacking (Prevention Demo with TLS/SSH)
Goal: Illustrate why encryption + integrity stops hijacking.
Setup:
• Run a simple HTTP server and capture traffic in Wireshark; show cookies/tokens
visible in plaintext.
• Repeat with HTTPS (self-signed ok for lab):
openssl req -x509 -nodes -newkey rsa:2048 -days 365 \
-keyout /etc/nginx/[Link] -out /etc/nginx/[Link]
Nginx TLS snippet:
server {
listen 443 ssl;
ssl_certificate /etc/nginx/[Link];
ssl_certificate_key /etc/nginx/[Link];
location / { try_files $uri $uri/ =404; }
Teach: HSTS, secure cookies (Secure, HttpOnly, SameSite), token binding, short session
lifetimes, MFA.
5. Internet Worms
• Definition: Self-replicating malicious programs that spread automatically.
• Example:
o ILOVEYOU Worm (2000): Spread via email attachments, overwriting files and
sending itself to contacts.
Internet Worm
Infected PC --> Spreads via network --> Other PCs infected
| |
v v
Emails, files, exploits → Massive spread
Worms & 6) Viruses (Containment & Scanning)
Goal: Understand propagation vectors and defenses.
Setup:
• Use a known-vulnerable VM (Metasploitable/DVWA) separated from production
networks.
• Install ClamAV: sudo apt install clamav && sudo freshclam
• Scan: clamscan -r /var/www/html
Teach: patching, least privilege, egress filtering, application allow-listing, backups & restore
drills.
6. Viruses
• Definition: Malicious code that attaches to files or programs, requiring user action to
spread.
• Example:
o Melissa Virus (1999): Spread via Word documents in emails, disabled security
settings.
Virus
[Link] + Virus Code --> Infected [Link]
When user opens → Virus executes & spreads
7. Spyware
• Definition: Software that secretly monitors user activity and collects information.
• Example:
o Keyloggers recording every keystroke, stealing passwords and banking details.
Spyware
User -----> [Spyware Installed] -----> Attacker
(Keylogger, Screen Capture, Data Theft)
Spyware (Detection & Hardening)
Goal: Spot suspicious persistence & outbound connections.
Setup:
• Baseline processes: ps aux, systemctl list-units --type=service
• Net connections: ss -tupn
• File integrity: sudo apt install aide && sudo aideinit
• Browser hardening: disable unnecessary extensions; use privacy settings.
Teach: EDR concepts, principle of least privilege, app permissions (mobile).
8. Phishing
• Definition: Tricking users into revealing sensitive information by impersonating
legitimate sources.
• Example:
o Fake email from “Bank” with link to a fake login page to steal credentials.
Phishing
User gets email: "Login to your bank"
|
v
Fake Website <--- Attacker
|
v
User enters password → Stolen
8) Phishing (Awareness & Technical Controls)
Goal: Show realistic phish indicators & protective layers.
Setup:
• Create a mock email (no links) with common tells: spoofed display name, urgency,
mismatched domain.
• Validate domains with dig and show DMARC/DKIM/SPF checks (using headers of
real, benign mail you control).
Teach: Password managers (domain matching), FIDO2 keys, email banners for external mail,
report workflow.
9. Botnets
• Definition: A network of compromised machines (bots) controlled remotely by
attackers.
• Example:
o Mirai Botnet (2016): Hijacked IoT devices, launching massive DDoS attacks.
• 9. Botnet
• Attacker (Botmaster)
• |
• v
• [Zombie PCs] --- Spread across world
• |
• v
• Launch DDoS, Spam, Data theft
9) Botnets (Network Detection)
Goal: Detect C2-like patterns (beaconing) in NetFlow/pcap.
Setup:
• Capture a few minutes of normal traffic: sudo tcpdump -i any -w [Link]
• Discuss beaconing (regular intervals to a single IP/Domain).
• IDS rule (Suricata/Snort) example for anomalous HTTP User-Agent (defensive
heuristic):
alert http any any -> any any (msg:"Suspicious User-Agent"; content:"User-Agent|3A|";
http_header; pcre:"/curl|python-requests|WinHTTP|libwww-perl/i"; sid:1000001; rev:1;)
Teach: IoT hardening (change defaults, no UPnP, VLAN isolation, auto-update).
10. TCP Session Hijacking
• Definition: Attacker takes over an established TCP connection by predicting sequence
numbers.
• Example:
o Attacker injects commands into a telnet/SSH session, gaining unauthorized
access.
• 10. ARP Spoofing
• Victim PC ----> (ARP Table Poisoned) ----> Attacker ----> Gateway
• Effect: Attacker intercepts traffic.
10) TCP Session Hijacking (Reinforce Defense)
Show:
• How TLS hides sequence numbers/cookies; Wireshark shows only encrypted payload.
• SSH with keys and ClientAliveInterval to reduce stale sessions.
11. ARP Attacks
• Definition: Exploiting the Address Resolution Protocol (ARP) by sending fake ARP
replies.
• Example:
o ARP Spoofing: Attacker poisons ARP table, making victim’s traffic pass
through attacker.
• 11. Route Table Modification
• Normal Routing: PC → Router → Internet
• Modified Routing: PC → Router (changed) → Attacker → Internet
11) ARP Attacks (Detection & Protection)
Goal: Catch ARP poisoning and block it.
Setup:
• Start arpwatch: sudo apt install arpwatch && sudo systemctl enable --now arpwatch
• Monitor: sudo journalctl -u arpwatch -f (MAC/IP pair changes trigger alerts)
12. Route Table Modification
• Definition: Malicious alteration of routing tables in a network device.
• Example:
o Attacker modifies router entries, redirecting packets to a malicious server
(blackhole attack).
• 12. UDP Hijacking
• User ----> DNS Query ----> Attacker injects fake reply
• "[Link]" → Attacker’s IP instead of real bank
12) Route Table Modification (Integrity Controls)
Goal: Detect unauthorized route changes.
Setup:
• Baseline routes: ip route show > [Link]
• Cron a check:
#!/usr/bin/env bash
ip route show | diff -u [Link] - || logger "ROUTE_CHANGE_DETECTED"
Network side:
• Router ACLs, authenticated routing (OSPF authentication, BGP TTL security/BFD,
prefix filters), config integrity monitoring.
13. UDP Hijacking
• Definition: Attacker intercepts or injects malicious packets into a UDP
communication.
• Example:
o DNS spoofing attack where attacker injects fake responses to DNS queries.
• 13. Man-in-the-Middle (MITM)
• Alice -----> Attacker -----> Bob
• <----- Attacker <-----
• Effect: Attacker reads/modifies communication secretly.
13) UDP Hijacking / DNS Spoofing (DNSSEC & Validation)
Goal: See why DNS needs integrity and how to verify it.
Setup:
• Use a validating resolver (Unbound or systemd-resolved with DNSSEC).
• Check DNSSEC:
dig +dnssec [Link]
; look for the AD (Authenticated Data) flag in the reply
Teach: DoT/DoH, response-rate limiting at the resolver, least-TTL for critical records, split-
horizon carefully.
14. Man-in-the-Middle (MITM) Attacks
• Definition: Attacker secretly intercepts and alters communication between two
parties.
• Example:
o Public Wi-Fi MITM: Attacker intercepts data (passwords, credit card numbers)
between user and website.
📌 Summary Diagram (Attack Categories):
Application Layer -> Buffer Overflow, Format String, Viruses, Worms, Spyware, Phishing
Network Layer -> TCP/UDP Hijacking, DoS, Botnets, Route Table Modification, MITM
Data Link Layer -> ARP Spoofing
Switch/Host defenses:
• DHCP snooping + Dynamic ARP Inspection (on managed switches)
• Static ARP for critical hosts (small segments)
• On Linux: sysctl -w [Link].arp_ignore=1 and arp_announce=2 (advanced;
explain pros/cons).
Snort rule (simple ARP anomaly):
alert arp any any -> any any (msg:"ARP cache poisoning attempt"; detection_filter:track
by_src, count 5, seconds 10; sid:1000002; rev:1;)
14) Man-in-the-Middle (MITM) (Certificate Pinning & HSTS)
Goal: Show TLS prevents passive MITM and how to harden web apps.
Setup:
• Compare HTTP vs HTTPS in Wireshark (plaintext vs encrypted).
• Add HSTS header in Nginx:
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
always;
App defenses:
• Certificate pinning (mobile), OAuth PKCE, signed requests, secure cookie flags,
Content-Security-Policy.
🔐 Extra: End-to-End Evidence Pack (for students)
Have students submit for each lab:
• Short write-up: objective, steps, observations, conclusions.
• Screenshots: Wireshark filters, logs (/var/log/*), IDS alerts, config snippets (rate
limits, HSTS).
• Fix verification: before/after behavior (e.g., unsafe vs safe C program output).
📦 Ready-to-Paste Snippets (Defensive)
iptables SYN rate limit (lab):
sudo iptables -A INPUT -p tcp --syn --dport 80 -m limit --limit 10/second --limit-burst 20 -j
ACCEPT
sudo iptables -A INPUT -p tcp --syn --dport 80 -j DROP
fail2ban Nginx (basic):
# /etc/fail2ban/[Link]
[nginx-req-limit]
enabled = true
port = http,https
filter = nginx-req-limit
logpath = /var/log/nginx/[Link]
maxretry = 50
findtime = 60
bantime = 900
Wireshark filters to teach:
• SYN flood focus: [Link]==1 and [Link]==0
• HTTP creds (HTTP only lab): [Link]
• ARP anomalies: [Link]-address-detected || [Link] == 2
Cookie Backup and Restore - Chrome Web Store
A Routing Table Attack in network security is a type of network-layer attack where the
attacker manipulates or corrupts the routing tables of routers or hosts to disrupt normal
communication, misdirect traffic, or enable eavesdropping.
🔹 What is a Routing Table?
• A routing table is a data structure maintained by routers and hosts that stores paths
(routes) to different network destinations.
• It decides where packets should be forwarded.
🔹 What is a Routing Table Attack?
In a routing table attack, an attacker alters or injects false routing information into the
routing table of a router or host. This causes packets to be:
• Dropped (causing Denial of Service).
• Rerouted (allowing eavesdropping or traffic analysis).
• Looped (causing congestion and network failure).
🔹 Methods of Routing Table Attacks
1. Route Spoofing / Injection
o Attacker advertises fake routes into the network.
o Example: Claims shortest path to a destination, so traffic passes through
attacker.
2. Route Table Overflow
o Floods the routing system with bogus routes.
o Router memory is exhausted → legitimate routes are dropped.
3. Blackhole Attack (common in MANETs / wireless networks)
o Attacker advertises itself as having the shortest path to all destinations.
o Packets routed to attacker → dropped (DoS).
4. Wormhole Attack
o Two colluding attackers tunnel packets between distant locations, misleading
routing decisions.
5. Man-in-the-Middle via Route Modification
o Attacker modifies route entries to intercept and analyze packets.
🔹 Consequences of Routing Table Attacks
• Traffic interception → confidentiality loss.
• Denial of Service (DoS) → traffic dropped.
• Network instability → frequent rerouting and loops.
• Performance degradation → increased latency and packet loss.
🔹 Defense Mechanisms
1. Authentication of Routing Updates
o Use cryptographic techniques (digital signatures, HMACs) in routing
protocols.
2. Secure Routing Protocols
o Examples:
▪ OSPF with authentication
▪ BGP with RPKI
▪ Secure AODV (SAODV) for MANETs
3. Route Consistency Checks
o Detect abnormal changes (sudden route hops, loops, or overload).
4. Access Control & Firewalls
o Prevent unauthorized devices from injecting routes.
5. Monitoring and Intrusion Detection
o Detect unusual routing behavior.