Python网络安全辅导 | FIT3031 Network Security Assignment
The learning objective of this assignment is for you to gain a first-hand experience on network attacks (i.e.,TCP and DNS attacks) and get a deeper understanding on how to launch these attacks in practice. All tasks in this assignment can be done on the virtual machine
https://cloudstor.aarnet.edu.au/plus/s/mbekAUzJG4PaxWz as used in Lab Week 8-Network Attacks.
In this section, you need to double check whether you have configured GNS3 correctly. We will be using the Week08 lab configuration, i.e., your GNS3 con guration should look like below:
Otherwise, if you just downloaded the VM for the fiperform lab taskts of Week08 before proceeding.
The Transmission Control Protocol (TCP) is a core protocol of the Internet protocol suite. It sits on top of the IP layer, and provides a reliable and ordered communication channel between applications running on networked computers. TCP is in a layer called Transport layer, which provides host-to-host communication services for applications. To achieve such reliable and order communication, TCP requiresboth ends of a communication to maintain a connection. Unfortunately, when TCP was developed, no security mechanism was built into this protocol, making it possible for attackers to eavesdrop on connections, break connections or hijack connections. In this section, you are required to perform these attacks using Scapy|a packet manipulation tool for computer networks written in Python.
In the stream of packets of a TCP connection, each packet contains a TCP header. In the header, there is a bit known as the “reset” (RST) ag. In most packets, this bit is set to 0 and has no effect; however, if this bit is set to 1, it indicates that the receiver should immediately stop using the TCP connection. That means it should not send back any more packets using the connection’s identifying numbers, called ports,and discard any further packets with headers belong to that connection. A TCP reset basically kills a TCP connection instantly.
It is possible for a third computer (aka attacker) to monitor the TCP packets on the connection and then send a “forged” packet containing a TCP reset to one or both endpoints. The headers in the forged packet must indicate, falsely, that it came from an endpoint, not the forger. This information includes the endpoint IP addresses and port numbers. Every eld in the IP and TCP headers must be set to a convincing forged value for the fake reset to trick the endpoint into closing the TCP connection.
The idea is quite simple: to break up a TCP connection between A and B, the attacker just spoofs a TCP RST packet from A to B or from B to A.
Q1: Connect from Internal-Client to Internal-Server using SSH (use apt install ssh if SSH is not installed), the username and password are same: msfadmin. Perform TCP RST attack,from Internal-Attacker workstation, on SSH service using Scapy (python-based) packet generator.
Internal-Client terminal should show the connection is terminated. Please submit your python code and the steps, along with video link showing that you have performed the attack. (Python code: 5 marks, explanation during recording demonstration: 5 marks)
Q2: Brie y explain the TCP RST attack and propose at least two theoretical countermeasures. You do not have to do any configuration/implementation for this task. (Explanation: 2.5 marks, counter-measures: 2.5 marks)