
Engage in hands-on labs and lab setup to grasp tcp/ip fundamentals, and explore attacks like session hijacking and Heartbleed while learning defenses with firewalls and vpn.
Explore how the IP layer routes incoming packets to the correct UDP or TCP transport, binds servers to ports, and uses sockets and recvfrom to deliver data to applications.
Explore packet spoofing by using raw sockets to bypass the OS network stack, construct complete IP and UDP headers in a zeroed buffer, and send a forged packet.
Explore the data link layer, mac layer, and layer 2 concepts, including ethernet headers and arp mapping, and examine arp cache poisoning and man-in-the-middle attacks.
Learn how the arp protocol resolves ip to mac addresses by broadcasting requests and receiving unicast replies, and how its cache speeds lookups.
Explore IP fragmentation and MTU limits from Ethernet 46 to 1500 bytes, including ID, offset, and fragmentation flags. See a hands-on demo constructing and reassembling fragments with UDP payload.
Explore attacks using IP fragmentation, including ping-of-death, teardrop, and overlapping fragments, showing how fragmented packets can trigger memory corruption and a denial-of-service attack in kernels.
Explains the icmp protocol at the ip layer, including icmp header fields, echo request/reply, time exceeded due to TTL or fragmentation, and destination unreachable codes.
Explore ICMP based attacks, including the smurf amplification via directed broadcast and spoofed source IP, plus ICMP flooding and botnets for denial of service.
Explore the network layer with ip and icmp protocols, ip fragmentation, routing tables and reverse path filtering, plus icmp attacks like redirect and smurf and bgp routing basics.
Explore the transport layer, including ports and port numbers, then examine the UDP protocol, how it works with the underlying network layer, and how UDP attacks are launched.
Explore why we need tcp beyond ip and udp, and how tcp provides a reliable, ordered, flow-controlled virtual connection with congestion control.
Watch a hands-on demonstration of the Mitnick attack, including configuring trust with .rhosts, spoofing syn packets, ARP cache manipulation, and backdoor rlogin access.
Examine the DNS attack surface along the full query path from the local host and /etc/hosts to the local DNS server and upstream roots, highlighting spoofing and cache risks.
Explore how fake DNS responses can poison caches and hijack domains, and how the authority and additional sections, plus glue records, influence caching and circular dependencies.
Learn how reverse dns lookup operates with the dns hierarchy from root to a domain's nameserver via in-addr.arpa, and why attackers can misuse the resulting name for access control.
Explore how DNS works, its hierarchy and query process, set up DNS servers and zones in labs, and examine cache poisoning, Kaminsky attack, DNS rebinding, and crypto-based countermeasures.
Create tun/tap interfaces using python and c, configure ip addresses with ip commands, and inspect packets with scapy and wireshark in a practical demo.
Explore tun and tap interfaces; tun links to layer 3 ip, tap to layer 2 ethernet, exposing layer-2 traffic and ethernet headers for virtual lan and bridged networks.
Explore IP anycast, where the same IP prefix is announced from global locations to balance load via BGP, directing UDP DNS requests to the nearest server.
Explore real-world BGP attack case studies, including Pakistan’s YouTube hijack and Turkey’s DNS hijack, and observe how misconfigurations redirect global traffic and prompt rapid fixes.
From Morris worm to Mitnick attack; from Mafia boy to Kaminsky attack; from Pakistan's hijacking of YouTube to Syria's shutting down of its own Internet. These are so many attacks on the Internet. If you want to learn how the Internet works, how it can be attached, and more importantly, how you can defend against these attacks, then this course is for you.
In this course, we systematically study each layer of the TCP/IP protocols, discuss the vulnerabilities in its design and implementation, and demonstrate how to exploit the vulnerabilities in attacks. Many classic attacks are covered in this course, with great technical details. The course won't just teach you the high-level concepts and theories; it would dive into the low-level technical details and fundamentals, so you can fully understand how exactly things work.
The course emphasizes hands-on learning. For each attack covered, students not only learn how the attack works in theory, they also learn how to actually conduct the attack, in a contained virtual machine environment. The hands-on exercises developed by the instructor are called SEED labs, and they are being used by over 1000 institutes worldwide. The course is based on the textbook written by the instructor. The book, titled "Computer & Internet Security: A Hands-on Approach, 2nd Edition", has been adopted by over 210 universities and colleges worldwide.