Internet Security: A Hands-on Approach

Explore packet sniffing and spoofing techniques and their role in TCP, ARP, and DNS attacks. Learn to implement sniffing and spoofing tools using Python with Scapy and C from scratch.

Explore socket programming and how applications hand data to the kernel to send UDP and TCP packets. Learn to construct sockets, specify destination IP and port, and test with netcat.

Explore how the IP layer routes incoming packets to the correct UDP or TCP transport, binds servers to ports, and uses sockets and recvfrom to deliver data to applications.

Learn how packet sniffing works by capturing all frames via promiscuous mode and raw sockets, bypassing IP processing, using OS-level direct copies and BPF filtering for efficient, low-level traffic capture.

Open a capture session with pcap, set a filter, and loop to process packets using lipcap and WinPcap/Npcap.

Sniff and analyze network traffic with Scapy in Python, building pcap-based sniffers, parsing Ethernet/IP layers, and inspecting udp/tcp data with filters.

Explore packet spoofing by using raw sockets to bypass the OS network stack, construct complete IP and UDP headers in a zeroed buffer, and send a forged packet.

Explore how Scapy enables packet spoofing in Python, constructing IP and UDP or ICMP layers in a few lines, and performing sniffing and spoofing with practical demos.

Compare Scapy and C for sniffing and spoofing, highlighting Scapy's ease, defaults, and object-based packet construction, and explain when C's speed justifies a hybrid approach.

Explain how byte order and endianness affect multi-byte data in memory and when communicating with another computer, and how host and network orders convert via htons, ntohs, htonl, and ntohl.

Learn to send packets with sockets, sniff and spoof using raw sockets and pcap, and compare C and Scapy for sniffing and packet construction in labs.

Explore the data link layer, mac layer, and layer 2 concepts, including ethernet headers and arp mapping, and examine arp cache poisoning and man-in-the-middle attacks.

Explore how the mac layer and ethernet headers enable end-to-end delivery of ip packets across routers, with attention to mac addresses, frame sizing, and privacy considerations.

Learn how the arp protocol resolves ip to mac addresses by broadcasting requests and receiving unicast replies, and how its cache speeds lookups.

Learn how ARP cache poisoning works by sending spoofed ARP requests, replies, and gratuitous messages to modify a target's mappings, using Scapy in a Linux VM.

Discover how ARP cache poisoning enables a man-in-the-middle attack by redirecting and spoofing traffic on a local network, enabling sniffing, interception, and modification.

Demonstrates a man-in-the-middle attack by arp cache poisoning to intercept and modify traffic between client and server, using sniffer tools, forwarding, and telnet/tcp sessions.

Analyze ARP cache poisoning, its man-in-the-middle risks, and how encryption serves as the best defense. Explore ARP, MAC, DNS, and ICMP redirect concepts with hands-on SEED lab activities.

Explore the IP layer's role, header and fragmentation, including how fragmentation can be attacked, plus routing, ICMP, and why IP offers best-effort delivery over TCP.

Learn how the IP protocol routes packets across networks, adds IP headers, handles routing and fragmentation, and uses time-to-live for traceroute and path discovery.

Explore IP fragmentation and MTU limits from Ethernet 46 to 1500 bytes, including ID, offset, and fragmentation flags. See a hands-on demo constructing and reassembling fragments with UDP payload.

Explore how IP fragmentation attacks exploit protocol rules by crafting abnormal packets to trigger memory corruption and denial-of-service through offsets and length fields.

Explore attacks using IP fragmentation, including ping-of-death, teardrop, and overlapping fragments, showing how fragmented packets can trigger memory corruption and a denial-of-service attack in kernels.

Explore routing at the network layer using a simple topology, build routing tables and default routes, and see how hosts and routers use ip route entries, dhcp, and 169.254 fallback.

Explore reverse path filtering in the Linux kernel to prevent spoofed packets on routers, and see how symmetric routing blocks external spoofing.

Explains the icmp protocol at the ip layer, including icmp header fields, echo request/reply, time exceeded due to TTL or fragmentation, and destination unreachable codes.

Explore icmp redirect attacks, where spoofed icmp type 5 messages redirect traffic to a router, enabling man-in-the-middle outcomes. Understand caching, local-lan constraints, and reverse path filtering that mitigates this threat.

Explore ICMP based attacks, including the smurf amplification via directed broadcast and spoofed source IP, plus ICMP flooding and botnets for denial of service.

Explore the network layer with ip and icmp protocols, ip fragmentation, routing tables and reverse path filtering, plus icmp attacks like redirect and smurf and bgp routing basics.

Explore the transport layer, including ports and port numbers, then examine the UDP protocol, how it works with the underlying network layer, and how UDP attacks are launched.

Explain how the transport layer uses port numbers to deliver data to the correct application, and contrast UDP's connectionless delivery with TCP's reliable, ordered stream.

Explore the UDP protocol and its eight-byte header with ports, plus a Python client-server example. Learn UDP use in DNS and real-time apps, and app-layer ordering and reliability.

Learn how UDP attacks leverage a simple, connectionless protocol to cause denial of service, including ping-pong behavior, UDP flooding with botnets, and amplification via DNS servers.

Explore how the transport layer uses port numbers to deliver packets to final applications. Contrast UDP and TCP and review UDP flooding and denial of service, with ping pong demo.

Explore how TCP works and contrasts with UDP. Analyze TCP attacks like SYN flooding attack, TCP reset packet, session hijacking, including the Mitnick attack and reverse shell, with hands-on labs.

Explore why we need tcp beyond ip and udp, and how tcp provides a reliable, ordered, flow-controlled virtual connection with congestion control.

Understand how tcp uses send and receive buffers as a pipe between client and server. Data is buffered and sent by timing and mtu limits, so boundaries require application-level handling.

Explain how tcp preserves order using per-byte sequence numbers, uses piggybacked acks, and implements flow control with sliding windows and window advertisements, while managing congestion with a congestion window.

Explore a syn flooding attack by exploiting the tcp three-way handshake to fill the server's half-open connection queue with spoofed syns, exhausting resources and prompting syn cookies as defense.

Learn how a tcp reset attack uses a spoofed reset packet to terminate a connection, matching the four-tuple and exact sequence number, often via sniffing and Scapy automation.

Explore TCP session hijacking, injecting data into an existing connection by spoofing packets that match sequence numbers, targeting telnet, and causing buffer synchronization failures.

Discover how a reverse shell lets an attacker control a remote bash by redirecting standard input and output via file descriptors 0, 1, and 2.

Explore how to redirect a process's standard input and output to a remote TCP connection using bash's /dev/tcp and netcat, and understand implications for reverse shells.

Learn to create a reverse shell by redirecting bash input, output, and error to a tcp connection using /dev/tcp and -i, with a single nc session.

This lecture explains the Mitnick attack, a tcp session hijack using spoofed syn packets, sequence-number prediction, and a trusted server and X terminal trust relationship, plus a hands-on lab.

Watch a hands-on demonstration of the Mitnick attack, including configuring trust with .rhosts, spoofing syn packets, ARP cache manipulation, and backdoor rlogin access.

Explore tcp security concepts, including the three-way handshake, reset and session hijacking, Mitnick attack, reverse shells, and practical countermeasures like randomized sequence and source port numbers with encryption.

Explore the dns protocol, its hierarchies, inquiry processes, and the broad attack surface, including dns cache poisoning, Kaminsky attack, dns rebinding, reverse dns lookups, and dns denial-of-service.

Explore the dns domain hierarchy, from root to tlds and ccTLDs, and see how zones and nameservers organize domains and subdomains.

Explore how the DNS query process works from a local DNS server through root servers to authoritative name servers, demonstrated with the dig tool and caching.

Understand how DNS root servers underlie the internet, using IP anycast and 13 root addresses, and trace zone file flow from root to TLD to your domain with practical steps.

Set up a three-machine lab to study dns attacks and resolution, configuring a user box, a local dns server, and an attack host hosting attacker32.com and example.com zones.

Learn to construct dns packets by building ip/udp headers and a dns header with transaction id, flags, and counts, plus records (questions and answers), using Scapy.

Examine the DNS attack surface along the full query path from the local host and /etc/hosts to the local DNS server and upstream roots, highlighting spoofing and cache risks.

Learn how local DNS cache poisoning uses sniffing and spoofing to inject spoofed replies, corrupt DNS caches, and hijack domains via the authority section and NS records such as ns.attacker32.com.

Explore the Kaminsky attack on remote DNS cache poisoning, including how random queries bypass cache and how a hybrid Python-Scapy and C approach crafts spoofed DNS responses in the lab.

Demonstrates the Kaminsky DNS cache poisoning attack with spoofed requests and responses, reveals cache manipulation and verification using DNSSEC and HTTPS as countermeasures.

Explore how fake DNS responses can poison caches and hijack domains, and how the authority and additional sections, plus glue records, influence caching and circular dependencies.

Learn how the dns rebinding attack bypasses the same-origin policy to reach IoT devices behind a firewall. The lecture demonstrates the browser protections and practical countermeasures.

Learn how reverse dns lookup operates with the dns hierarchy from root to a domain's nameserver via in-addr.arpa, and why attackers can misuse the resulting name for access control.

Denial-of-service attacks on DNS disrupt name-to-IP translation, threatening internet access from root servers to country TLDs, with cases using IoT devices like cameras and baby monitors.

Explore how DNS works, its hierarchy and query process, set up DNS servers and zones in labs, and examine cache poisoning, Kaminsky attack, DNS rebinding, and crypto-based countermeasures.

Learn why vpn is needed and how ip tunneling via tun/tap interfaces works, with python and c implementations and labs to build and test a simple vpn.

Introduce vpn by explaining why it's needed, and use an armored train analogy to reveal ip tunneling and ssh tunneling (port forwarding) with encryption, integrity, and authentication.

Compare ssh tunneling with ip tunneling, explain how routing table changes redirect traffic to the tunnel, and how ip tunneling encapsulates a packet inside another using tun/tap in user space.

Explore the tun/tap virtual interface as the kernel to application bridge for vpn tunnels, detailing tun vs tap, ip vs mac headers, and routing.

Create tun/tap interfaces using python and c, configure ip addresses with ip commands, and inspect packets with scapy and wireshark in a practical demo.

Explore tun and tap interfaces; tun links to layer 3 ip, tap to layer 2 ethernet, exposing layer-2 traffic and ethernet headers for virtual lan and bridged networks.

Explore how a VPN routes a packet through a private network using a tun interface and IP tunnel, with a lab setup of host U, VPN server, and host V.

See how a vpn server processes an encrypted payload: unpacks it via a tun interface, then routes it through the kernel to a private network destination.

Learn how packets return over a VPN tunnel by understanding how source IP is chosen from the outgoing interface, and how to configure routing and multi-interface monitoring with select.

Explore how a vpn tunnel encapsulates the original packet inside a new ip header and encrypts it via the tun program. Understand routing entries that direct traffic to the tunnel.

Examine a real vpn case study using sura to connect to Syracuse University through a vpn tunnel, showing routing tables, tun interface, and firewall bypass concepts.

Discover how VPN bypasses both egress and ingress firewalls by tunneling traffic through a VPN server, enabling access to blocked sites, including AP scores, in a hands-on lab.

Learn how VPN works through SSH and IP tunneling, using TUN/TAP to build a transparent IP tunnel, with a case study of Syracuse University and hands-on labs.

Delve into firewall concepts, implement a simple firewall using netfilter and iptables, and explore packet filter, stateful, and application firewalls with ingress and egress protections.

Explore how netfilter provides kernel hooks to inspect IP and transport-layer headers and decide whether to drop or forward, enabling a mini-firewall and network address translation and load balancing.

Build a simple firewall by loading a kernel module that hooks into netfilter, inspects tcp packets on port 23, and blocks telnet traffic, using post routing or local_in hooks.

Explore iptables, built on netfilter, and how kernel-space hooks and user-space rules organize firewall decisions with filter, nat, and mangle tables.

Learn how to implement nat with iptables using source nat to let private networks share a single public ip, and configure post routing and ip forwarding for traffic translation.

Explore how iptables implements destination NAT (DNAT) to forward ports and balance traffic across multiple servers, using port forwarding and round-robin policies.

Explore iptables extensions using match and target extensions to modify packets. Learn to throttle traffic with limit and enforce user rules with owner, and adjust time to live.

Explore stateful firewall concepts and connection tracking with Netfilter, conntrack, and iptables, showing how rules permit outgoing traffic only for established or related connections.

Discover how ssh tunneling and port forwarding bypass firewalls for convenient access, using local port forwarding, remote port forwarding, and dynamic port forwarding, with proxies and socks; compare to vpn.

Learn how firewalls work with netfilter and iptables, implement nat, and apply stateful rules using connection tracking, plus lab activities on ssh tunneling and vpn bypass.

Explore how border gateway protocol binds autonomous systems through peering into the internet, how BGP attacks occur, and how IP anycast and traceroute reveal routing behavior.

Explore how internet routing uses routing tables and BGP among autonomous systems to build a dynamic map. See how BGP speakers disseminate reachability so internal routers act as signs.

Explore how autonomous systems vary in size and use BGP peering and IXP connections to exchange routes, with Syracuse University AS 11872 linking to Cogent, NYSERNET, and Level3.

See how BGP uses TCP to form sessions between autonomous systems and exchange updates. Prefix advertisement, AS path, next hop, and keep-alive messages enable reachability and dynamic path selection.

Explore how autonomous systems choose the best BGP path among multiple peers using weight and local preference, then the shortest AS path length, with prepending used to create backup routes.

Explore how BGP resolves overlapping routes with the longest-prefix match, illustrated by /19 and /20. See how globalization and de-aggregation enable traffic distribution and load balancing across global links.

Explore IP anycast, where the same IP prefix is announced from global locations to balance load via BGP, directing UDP DNS requests to the nearest server.

Explore practical BGP tools and utilities, including ripe.net's neighbor widget and BGP collectors with looking glasses, to visualize AS paths, prefixes, and peering relationships.

Explore how BGP prefix hijacking exploits the longest-prefix match to redirect and drop traffic, and learn defenses using TTL filtering, RFC 7454 guidance, PKI, and active monitoring.

Explore real-world BGP attack case studies, including Pakistan’s YouTube hijack and Turkey’s DNS hijack, and observe how misconfigurations redirect global traffic and prompt rapid fixes.

Explore how autonomous systems, peering, and BGP enable internet routing and traffic flow, while examining IP anycast, BGP attacks, and defenses.