Site icon TheCyberThrone

CEH V13 Detailed Notes Part IV

PravinKarthik
Advertisements

Introduction on modules

Module 10 — Denial-of-Service (DoS) Attacks

DoS and DDoS attacks aim to exhaust system, network, or application resources to make services unavailable.
Understand attack types — volumetric, protocol, and application-layer — and tools like LOIC, HOIC, and botnets.
Learn about mitigation: rate limiting, CDN protection, load balancing, and incident response for availability resilience.

Module 11 — Session Hijacking

Session hijacking targets user sessions by stealing or predicting session tokens to impersonate valid users.
Study TCP/IP hijacking, cross-site scripting, cookie theft, and man-in-the-middle exploitation.
Defend using SSL/TLS, secure cookie attributes, regeneration of session IDs, and intrusion detection systems.

Module 12 — Evading IDS, Firewalls, and Honeypots

Attackers use evasion techniques to bypass security monitoring systems and stay undetected.
Explore fragmentation, encryption, obfuscation, tunneling, and spoofing to slip past defenses.
Learn countermeasures like deep packet inspection, anomaly detection, and network segmentation.

Module 10: Denial-of-Service (DoS) Attacks

1. Introduction to DoS and DDoS

Definition

Objective

2. DoS Attack Categories

A. Volume-Based Attacks

B. Protocol Attacks

C. Application-Layer Attacks

3. Common DoS Techniques and Tools

A. Network Layer

B. Application Layer

C. Distributed DoS

4. Amplification Attacks

Concept:

Use protocols with a larger response than request to multiply attack volume. Protocol Amplification Factor Description DNS 28–54x Open resolver exploited via spoofed queries NTP 550x Monlist command abused SSDP 30x Exploits UPnP devices Memcached 50,000x Exploits UDP mode responses

Goal: Amplify small requests into huge traffic bursts toward the victim.

5. Botnets and Attack Architecture

A. Components

  1. Botmaster / Attacker – Controls the operation.
  2. C2 Server – Issues attack commands.
  3. Bots / Zombies – Compromised devices executing the attack.
  4. Victim – Target system or service.

B. Types of C2 Control

6. DoS Tools (for Ethical Testing)

(Ethical use only in authorized environments for testing or academic purposes.)

7. Indicators of a DoS/DDoS Attack

8. Defensive Strategies and Countermeasures

A. Infrastructure-Level

B. Network-Level

C. Application-Level

D. Architectural Defenses

E. Monitoring & Response

9. Real-World Examples

10. Summary

11. Exam Tips

Know attack types by OSI layer.
Remember amplification factors and exploited protocols.
Understand botnet control models (IRC, HTTP, P2P).
Be ready for tool identification questions (e.g., Slowloris vs HOIC).
Focus on mitigation hierarchy (Prevent → Detect → Respond → Recover).

Module 11: Session Hijacking

1. What is Session Hijacking?

Session hijacking is the act of taking over a valid, authenticated session between a user and a service so the attacker can act as that user without logging in.
It targets session identifiers / tokens (cookies, bearer tokens, session IDs, TLS sessions, TCP sessions) rather than credentials directly.

Why it matters: If an attacker obtains a session token they can bypass authentication controls, access sensitive data, and perform privileged actions.

2. Session concepts you must know

3. Main attack techniques (overview + practical indicators)

A. Cookie / Token Theft (most common)

B. Man-in-the-Middle (MITM) & ARP poisoning

C. Cross-Site Scripting (XSS)

D. Session Fixation

E. Session Prediction

F. TCP Session Hijacking (low level)

4. Tools & practical examples (for authorized testing / labs)

Ethical note: Use these tools only in labs or with explicit written permission.

5. How session hijacking is detected (for defenders)

Useful detection rules / behaviors:

6. Strong mitigations & secure session management (how to prevent hijacking)

A. Transport-level protections

B. Cookie & token hardening

C. Application controls

D. Network / infra controls

7. Best practices for session lifecycle

  1. Generate token on successful authentication.
  2. Store token server-side mapping to session state (not sensitive data).
  3. Set Secure, HttpOnly, SameSite.
  4. Regenerate token on login and privilege escalation.
  5. Implement inactivity timeout + absolute session timeout.
  6. Invalidate token on logout; blacklist tokens until expiry.
  7. Use short TTL + refresh tokens (if applicable), with refresh rotation & revocation support.
  8. Log session creation/termination and anomalous reuse.

8. Quick checklist — defensive posture

Module 12: Evading IDS, Firewalls, and Honeypots

1. Module overview

Attackers don’t just try to break into systems — they want to avoid being detected while doing it. This module examines techniques adversaries use to bypass intrusion detection systems (IDS), firewall protections, and deception systems (honeypots), and it covers how defenders can detect, harden, and respond. Understanding evasion improves red-team realism and helps defenders close visibility gaps.

2. Core concepts: how detection works

IDS and IPS solutions inspect network and/or host activity for signs of compromise. Signature-based detection looks for known patterns (signatures) and is excellent for known threats. Anomaly-based detection builds a baseline of “normal” behavior and flags deviations. Firewalls enforce policy at the network and application layers, filtering or proxying traffic. Honeypots are decoy systems designed to attract attackers to study their methods. Evasion techniques either hide malicious actions from these controls or manipulate traffic so controls misclassify it as benign.

3. Evasion families and the idea behind them

Evasion techniques generally aim to do one (or more) of the following: fragment or obfuscate payloads so signatures miss them; disguise malicious traffic inside allowed protocols; slow or time-shift traffic to evade rate-based detection; encrypt or tunnel malicious content so deep inspection can’t see inside; fingerprint and avoid honeypots; or abuse legitimate services/protocols to blend in. Attackers will typically chain multiple techniques.

4. Packet-level evasion: fragmentation and insertion

Attackers split malicious payloads into many tiny fragments or craft packets with unusual offsets so a naive signature engine can’t reconstruct the original malicious content. Packet insertion and evasion occur when an attacker sends extra packets or malformed packets to create ambiguity between what endpoints see and what the IDS sees. Tools like fragroute/fragrouter (or custom packet crafting with scapy/hping3) can produce these effects. Defenders must reassemble fragments before inspection and validate protocol behavior to prevent evasion.

5. Protocol obfuscation and encoding

Malicious data can be encoded (Base64, URL encoding, double-encoded) or disguised as legitimate application-layer traffic to bypass pattern matching. For example, shellcode or exploit payloads inside seemingly harmless HTTP POST bodies or inside multipart file uploads. Attackers also use non-standard ports for common protocols (e.g., SSH on high ports) and craft protocol states to make the session appear normal. Defenders should apply deep packet inspection (DPI) and protocol-aware parsing to detect anomalies.

6. Tunneling and encryption to hide traffic

Tunneling malicious traffic over allowed protocols (HTTP(s), DNS, ICMP) hides content from simple filters. DNS tunneling and HTTP tunneling are popular: they encapsulate commands or data in DNS queries/responses or HTTP requests. Encrypted tunnels (SSL/TLS, SSH) or VPNs hide payloads from signature engines; attackers may use legitimate TLS to hide C2 or exfiltration. Defenders should use TLS inspection where feasible (with privacy and legal considerations), monitor metadata (hostnames, unusual handshake behavior), and apply behavioral baselining.

7. Timing & low-and-slow techniques

Instead of blasting payloads quickly (which triggers volume/threshold detectors), attackers send activity at low rates or spread steps across long windows to remain below detection thresholds. Examples: very slow HTTP POSTs, long gaps between command-and-control callbacks, or timed small data exfiltration. These are hard for signature systems; anomaly detection with long-term baselining and correlation is required to spot them.

8. Polymorphism and metamorphism

Polymorphic techniques change the payload signature on each instance (e.g., simple encoding or XOR), while metamorphic techniques recompile or rewrite code to change its structure. These approaches defeat signature-based AV/IDS because the byte patterns change. Behavior-based detection, sandboxing, and dynamic analysis are stronger defenses because they analyze what code does rather than how it looks.

9. Use of legitimate services and living-off-the-land

Attackers abuse legitimate tools and services already trusted inside the environment (PowerShell, WMI, system utilities, cloud storage, widely used SaaS) to reduce noise and bypass controls. This is often called “living off the land.” When an attacker’s actions are ordinary admin-like actions, signature detection struggles. Defenders should implement application allow-listing, restrict high-risk tool use, and enable command logging and behavioral analytics for admin utilities.

10. Firewall evasion techniques (concepts & examples)

Common firewall evasion methods include IP spoofing to appear as a trusted source, source-port manipulation or using ports allowed by policy (e.g., tunneling over HTTPS), and proxying through chained proxies or anonymizing networks like Tor. Port knocking is a stealthy technique where an attacker sends a secret sequence of connection attempts to open a port; conversely, attackers exploit overly permissive outbound rules to stage C2. Defenders should apply strict egress filtering, inspect HTTPS traffic where possible, and use reverse-proxy or application-level gateways for sensitive services.

11. Honeypot detection and avoidance

Attackers attempt to fingerprint their environment to determine if they’ve hit a honeypot. Indicators include unrealistic system responses, missing expected OS artifacts, predictable service banners, high latency patterns, or known honeypot process names. Advanced attackers will probe file systems, measure timing, and run benign commands to check authenticity. Effective honeypots reduce detectability by randomizing responses, mimicking real services closely, and using hybrid deception techniques. Security teams should ensure honeypots are indistinguishable from production systems to increase capture fidelity.

12. Tools commonly used for evasion (red-team examples)

13. How defenders detect evasion: signs and signals

Evasion leaves traces if you look for them. Look for inconsistent protocol state transitions, mismatched packet reassembly results, unusual fragmentation patterns, repeated partial requests, or a high rate of malformed packets. Metadata anomalies such as unusual destination hostnames, abnormal session durations, or rare user-agent strings are red flags. On hosts, look for execution of rarely used admin utilities, unexpected outbound encrypted sessions, or new services that persist. Centralized logging (SIEM) with correlation rules, network telemetry, and endpoint visibility (EDR) are essential to catch subtle evasion.

14. Defensive hardening measures (practical)

15. Incident handling & response considerations

When evasion is suspected, isolate affected segments, preserve packet captures (PCAPs) and full system images, and escalate to threat hunting. Correlate network anomalies with endpoint telemetry to find the true source. Because evasion often hides C2 and exfil, hunt for unusual outbound connections, anomalous TLS usage, or DNS anomalies. Use sandboxing to detonate suspicious payloads and compare dynamic behavior versus static signatures.

Quick memory lines

Exit mobile version