Printable View
Hi friends........i'm doing a project in Network Security, and my prof has asked me to learn about various types of attacks.........since it is such a large field i'm having trouble finding appropriate resources..........can someone plz help me out here :confused:
Hello!
Welcome to the Antionline community!
I am not a software security expert, but I am found it in google. ;)
http://www.crucialp.com/resources/tu...ow-and-why.php
There are five forms of attacks commonly used against computers and networks, according to Aaron Turpen, in his article 'Hacker Prevention Techniques.'
1. Distributed Denial of Service (DDoS) attacks
* usually aimed at networks by third party systems (typically, compromised systems lacking security that unwittingly become hacker accomplices)
* focuses on open ports and connections in the network or system
* they undermine the network by flooding it with requests and "pings," thereby causing one or more systems and their resources to shut down or crash
* major systems usually recover from such attacks easily and completely
2. Trojan Horse
* software disguised as something else (typically useful shareware or freeware) and so are installed in your system consciously
* it either contains
o a "back door," (which allows others to enter your system, and do what they want with it, while you're using the software), or
o a "trigger," (sets itself off when triggered, either by a date or a time or a series of events, etc., and cause your system to shut down or attack other computers; can be part of a DDoS attack
* SpyWare is a less malicious version (it fills commonly-used form fields for you while also collecting information to send to advertisers and marketing companies)
* difficult to detect
3. Virus
* most common
* primary concern is to replicate and spread itself, and then destroy or attempt an attack on the host system
* examples include: I Love You; Crazy Boot, Cascade; Tequila; Frodo
4. Websites - malicious sites that use known security holes in certain Web technologies to trigger your web browser to perform unwanted functions in your system (ex. an older version of ActiveX had a "hole" that allowed content in any one folder or directory on your hard drive to be automatically uploaded to a web directory or emailed to a receiver)
5. Worm
* it consumes resources (quietly) until the system finally becomes overloaded and ceases to function
* a combination of a DDoS and a virus attack
* usually reproduces as often as possible to spread as widely as they can
* typically built for a certain type of system and is benign to all others
* commonly aimed at larger systems (mainframes, corporate networks, etc.); some are built to "consume" data and filter it back out to unauthorized users (i.e. corporate spies)
* examples are Sobig and Mydoom
Hope others guys can help you.
Cheers,
AarzaK
Welcome to AO! I would say Aarzak gave you a pretty definitive list there. Not much to add. Well done Aarzak.
thnx for the quick reply..............another thing i wanted to ask is that my prof has also asked me to implement some of these attacks , but without using any tools , and my knowledge in this field is somewhat limited to socket programming in C and creating sniffers, scanners.........so what else do i need to know in this field
Do the above 5 forms of attack cover the entire range..........moreover i sort of need a detailed info on these..........hope u can help a bit more..........thnx
Nice move to get someone to explain how to hack ...
I'm going to have to agree with cider. Professors will not usually ask you to do something that has not already been covered in a course.
If it bothers you that badly then why do you two feel so compelled to announce that you are annoyed by his questions... to which you really have nothing to add beyond your complaints anyway. I don't think this is the sort of behavior associated with intellectual computer users.
If you could (for example) hook the winsock librarys then surely you could host web-based scripts which are open to SQL injection, remote file inclusion, and XSS then exploit these flaws with nothing but a browser.Quote:
and my knowledge in this field is somewhat limited to socket programming in C and creating sniffers
Most quite simply due to the fact that this board is plagued with "how do i hack x" posts. Mabey I was entirely wrong and the class is teaching theoretical network security and asking for students to show examples from research materials that were not offered by the course.
And that really is the point, and the most difficult thing for us to ascertain here. Is the question really a security question, or a hacking question masquerading as one? The line can become almost invisible sometimes, but we still have to try to find it.
to websites i would recommened you take a looksie at.
http://www.0x000000.com/?
http://milw0rm.com
I think what really pisses people off is that the more people say words like hack or hacker, the less people talk about computers. And the fact of the matter is that right now you, me, and even the administrator of this site are just taking things one extra step downward.Quote:
And that really is the point, and the most difficult thing for us to ascertain here. Is the question really a security question, or a hacking question masquerading as one?
:) Um... hah!Quote:
Not much to add.
This will keep you occupied for a while:Quote:
Originally Posted by VeerGiant
SANS: Reading Room
Meh...
I've seen two useful responses to his question.
Oh yeah...
Quit bitching. Nobody really cares.Quote:
And that really is the point, and the most difficult thing for us to ascertain here. Is the question really a security question, or a hacking question masquerading as one?
Frankly, I don't care whether you do or not. It doesn't concern you.
Hey rtl.........actually i'm working on linux, so should i know the complete details of socket.h instead of winsock
and thnx SirDice that site is proving to be quite informative
VeerGiant,
It would help if you gave us the precise instructions you have been given.
In particular, I would like to know what the deliverable is supposed to be. Is it a presentation? a 15,000~25,000 word dissertation or whatever?
I am afraid that you might be falling into the trap of going for the detail too early on. You really need to create a top level plan of action first;)
Nobody ever bothered to tell my lot that! :D Actually, a part of your university education is being able to demonstrate the capacity to conduct independent research in an area you have not been spoon fed.Quote:
Professors will not usually ask you to do something that has not already been covered in a course.
As you noted in your first post, this is a huge subject area, so your problem is going to be one of selection. Incidentally, what is your deadline?
To restrict this project to manageable proportions you are going to have to carefully define your scope, and you need to do this first.
EDIT: I really don't see how this can be taken as anything other than a request for mentoring/advice regarding an academic project.
If I wanted to do anything malicious I would need to know:
1. Hardware platform(s)
2. Operating System(s)
3. Applications
4. Network Architecture
5. Access Vectors
Absolutely none of those have been mentioned :halo:
As far as things you can demonstrate without using any special software you should show your teacher XSS and SQL Injections.
http://en.wikipedia.org/wiki/Cross-site_scripting
http://en.wikipedia.org/wiki/SQL_injection
Well maybe i've not explained my problem clearly.
I have just completed my 2nd year in BTech and i approached my prof for a project related to network security. Since both the networking and OS courses are in the next semester, my prof told me that he would not be able to give me a specific task in security but for these holidays told me to study the various types of attacks and try to implement some of them, and implementation of this knowledge will be done in the winter vacations after the next semester when he would give me a specific security related task.
So for the time being i am trying to categorize all the attacks, and learning raw socket programming.
I hope this clears things out.