Network Attacks & Mitigations
TαΊ₯n cΓ΄ng MαΊ‘ng & Biα»n phΓ‘p PhΓ²ng chα»ng
Comprehensive Attack Reference Table
For each attack, know: which OSI layer it targets, the mechanism, and the specific mitigation. These are high-frequency exam topics β memorize the layer-attack-mitigation triple for each.
| Attack | Layer | Mechanism | Primary Mitigation |
|---|---|---|---|
| SYN Flood | L4 | Sends massive TCP SYN packets without completing the 3-way handshake, exhausting the server's connection state table with half-open connections | SYN cookies (server doesn't store state for unacknowledged SYNs), firewall rate limiting, stateful firewall connection limits |
| ARP Poisoning | L2 | Sends gratuitous ARP replies associating the attacker's MAC address with a legitimate IP, redirecting traffic through the attacker (LAN MITM) | DAI (Dynamic ARP Inspection) on managed switches, static ARP entries for critical devices, 802.1X |
| VLAN Hopping | L2 | Double-tagging 802.1Q frames to escape attacker's VLAN, or exploiting DTP (Dynamic Trunking Protocol) to negotiate a trunk link and access all VLANs | Disable DTP on all non-trunk ports, use a dedicated native VLAN ID not used for any user traffic, prune unused VLANs from trunks |
| DNS Poisoning | L7 | Inject malicious DNS records into a resolver's cache to redirect users to attacker-controlled IP addresses | DNSSEC (signed DNS records), RPKI for BGP-level protection, randomized source ports and transaction IDs |
| DDoS (Volumetric) | L3/L4 | Overwhelm network bandwidth with massive volumes of traffic (UDP flood, ICMP flood, DNS amplification) using a botnet β traffic volume exceeds available bandwidth | CloudFlare/Akamai/AWS Shield scrubbing centers (absorb at scale), anycast routing, ISP-level blackholing (RTBH) |
| DDoS (Application L7) | L7 | Overwhelm web application with HTTP requests that appear legitimate β Slowloris (slow headers), HTTP flood, credential stuffing bots | WAF rate limiting, CAPTCHA challenges, bot detection (behavioral analysis), CDN caching to reduce origin load |
| Man-in-the-Middle | Multi | Attacker intercepts and optionally modifies traffic between two communicating parties β can be achieved via ARP poisoning (L2), rogue AP (L2), BGP hijack (L3), or SSL stripping (L7) | TLS with certificate validation, mTLS, HSTS, certificate pinning, VPN for untrusted networks |
| IP Spoofing | L3 | Send packets with a forged source IP address to impersonate another host, bypass IP-based access controls, or amplify DDoS attacks | BCP38 ingress filtering (ISP-level β block packets with source IPs not belonging to the originating network), anti-spoofing ACLs |
| BGP Hijacking | L3 Routing | Malicious or misconfigured router announces false BGP routes, attracting traffic destined for legitimate networks β can redirect internet traffic globally | RPKI (Resource Public Key Infrastructure) β cryptographically signs BGP route announcements. BGP monitoring services (Cloudflare Radar, BGPmon). |
| SSL Stripping | L7 | MITM attacker intercepts HTTP redirect to HTTPS, serves HTTP to the client while maintaining HTTPS upstream β client unknowingly communicates in plaintext | HSTS preloading (browser always uses HTTPS, refuses HTTP even before redirect), force HTTPS at load balancer |
| Pass the Hash | L7 Auth | Attacker extracts NTLM password hash from memory (using Mimikatz) and uses the hash directly to authenticate without knowing the plaintext password β hash IS the credential in NTLM | Disable NTLM authentication, use Kerberos instead, Windows Credential Guard (protects hash in memory), least privilege |
DoS vs DDoS β Key Differences
- β’ Single source β one attacker machine
- β’ Easier to block β just block that source IP
- β’ Limited by single machine's bandwidth
- β’ Attacker's machine may be detectable/traceable
- β’ Thousands or millions of sources (botnet)
- β’ Cannot block by IP β traffic looks legitimate
- β’ Traffic volumes that overwhelm any single site
- β’ Requires upstream scrubbing (CloudFlare, Akamai)
Botnets
A botnet is a network of compromised devices (computers, IoT devices, routers) controlled by an attacker (botmaster) via a Command and Control (C2) infrastructure. Botnets are used for:
SYN Cookies β How They Work
SYN cookies solve SYN flood by eliminating server state for unacknowledged connections:
Key Terms
Layer 4 DoS β exhausts server TCP connection table with half-open connections. Mitigated by SYN cookies.
Server-side mitigation β uses a cryptographic cookie as ISN so no state is stored for unacknowledged SYN connections.
Layer 2 MITM attack β fake ARP replies redirect LAN traffic through attacker. Mitigated by DAI on switches.
Switch feature that validates ARP replies against DHCP snooping binding table. Drops spoofed ARP at Layer 2.
Layer 2 attack β escape VLAN segmentation via double-tagging or DTP exploitation. Disable DTP to prevent.
Cisco proprietary β allows switches to auto-negotiate trunk links. Disable on all non-trunk (access) ports to prevent VLAN hopping.
Distributed Denial of Service β thousands of sources overwhelming a target. Requires upstream scrubbing (CloudFlare, Akamai).
False BGP route announcements redirect internet traffic. Mitigated by RPKI β cryptographic signing of route origins.
Resource Public Key Infrastructure β cryptographically binds IP prefixes to ASNs (Autonomous System Numbers) to validate BGP routes.
RFC 2827 β ISP-level ingress filtering that blocks packets with source IPs that cannot legitimately originate from that network. Prevents IP spoofing and DDoS amplification.
Attacker intercepts communication between two parties. Can be active (modifies data) or passive (eavesdrops). Mitigated by TLS/mTLS.
Use stolen NTLM hash directly as credential without cracking it. Disable NTLM; use Kerberos; deploy Credential Guard.
HTTP Strict Transport Security β browser-enforced HTTPS. Prevents SSL stripping by refusing HTTP connections even before redirect.
Network of compromised devices controlled via C2 infrastructure. Used for DDoS, spam, credential stuffing, crypto mining.
- SYN cookies: server doesn't store half-open connections. The cryptographic cookie in the SYN-ACK's ISN encodes the state β only extracted when a valid ACK returns. Legitimate clients respond; spoofed IP addresses cannot.
- ARP operates at Layer 2 β DAI mitigates at Layer 2. Both the attack and the control are at the Data Link layer. DAI requires DHCP snooping to be enabled first (the binding table is the source of truth).
- VLAN hopping requires DTP to be enabled β disable DTP on all access ports (
switchport nonegotiate). Also: the native VLAN (untagged VLAN) must be a dedicated ID not used for any user or management traffic. - HSTS prevents SSL stripping by telling the browser to ALWAYS use HTTPS for the domain for a specified period. The browser will refuse an HTTP connection even if an attacker removes the HTTPS redirect. HSTS preloading extends this to first-visit protection.
- DDoS mitigation: CloudFlare/Akamai are better than on-premises for volumetric attacks β they have terabit-scale scrubbing capacity and anycast routing to absorb attacks close to their source. On-premises appliances cannot absorb 100+ Gbps volumetric floods.
- Volumetric DDoS: CloudFlare absorbs at edge before traffic reaches GCP. CloudFlare's scrubbing capacity is multi-terabit β no on-premises solution needed. Ensure CloudFlare "Under Attack Mode" is tested and understood by the team. Configure automatic mode activation via CloudFlare Workers or Firewall Rules triggered by traffic anomalies.
- Application-layer DDoS (HTTP flood) on Partner C: CloudFlare WAF rate limiting (e.g., 100 requests/minute per IP to public endpoints). CAPTCHA challenge for suspicious request patterns. Bot Fight Mode enabled on CloudFlare. This is highest priority β Partner C has the most public exposure (PH market, consumer-facing loan application).
- OTP brute-force (L7 application DoS): Rate limit: 5 OTP attempts per phone number per hour (sliding window in Redis). Implement account lockout after 10 failed OTPs across 24 hours. This is separate from WAF β enforced at application layer in Platform C API service.
- Partner D B2B API β DDoS surface elimination: Fixed-IP allowlist at GCP firewall layer (only Partner D's registered IPs can reach the endpoint). All external IPs are hard-rejected at L3 before reaching the application. This eliminates virtually all external DDoS attack surface on the Partner D API endpoint.
- SFTP (Partner D batch): Fixed-IP allowlist + certificate-based authentication. No password authentication. Rate limit concurrent sessions. Monitor for unexpected file upload volumes (anomaly detection).
- SSL Stripping: All TS domains served via CloudFlare with HSTS enabled (max-age=31536000, includeSubDomains). Force HTTPS at CloudFlare edge. No HTTP-accessible endpoints.
- Pass the Hash: TS engineers use GCP IAM with short-lived OAuth tokens (not NTLM). Production Vault uses Kubernetes ServiceAccount JWT tokens. No NTLM in the environment β but verify any Windows-based jump hosts or legacy systems in VPN path.
Practice Quiz β Network Attacks & Mitigations
Q1. How do SYN cookies defeat a SYN flood attack?
Q2. ARP poisoning is best mitigated at Layer 2 by which control?
Q3. VLAN hopping via DTP exploitation can be prevented by which specific configuration?
Q4. How does HSTS prevent SSL stripping attacks?
Q5. Why is DDoS generally harder to block than DoS?
You've Finished Domain 4: Network Security
6 lessons covering OSI layers, firewalls, VPN/TLS, wireless, email/DNS security, and network attacks. Review the key themes: match every attack to an OSI layer, and every control to its layer. Then move on to Domain 5: Identity & Access Management.
Continue to Domain 5: IAM β