COMP SCI 3308 Cybersecurity Fundamentals_ Assignment 4 Sample Answers

Assignment 4 Sample Answer 1. (3 points) DHCP Attack 1

1) What are the 4 packets (messages) that are communicated between the client seeking and IP address and the DHCP server?

As per Wikipedia:the 4 packets are: DISCOVERY, OFFER, REQUEST and ACKNOWLEDGE.

2) Are the 4 messages Layer 2 unicast or broadcast (be careful not to confuse between Layer 3 broadcast, which is sending to an IP broadcast address like 10.0.2.255, as opposed to Layer 2 broadcast which is sent to MAC address FF:FF:FF:FF:FF:FF).

DISCOVERY and REQUEST are Layer 2 broadcasts, as the requesting client does not yet have an IP address, and does not know where the DHCP server is.

OFFER and ACKNOWLEDGE in theory are Layer 2 unicasts, as the DHCP server know the physical (MAC) address of the requesting computer.

3) Therefore, in a switched network, which of the 4 messages in the DHCP negotiation would the attacker be able to observe?

Even on a Layer 3 switched network, the attacker is able to observe DISCOVERY and REQUEST, unless DHCP snooping is enabled on the switch.

4) Briefly explain what DHCP spoofing and DHCP starvation attacks are executed, and how the two can be used in combination.

DHCP spoofing is simply the attacker sending a forged (spoofed) DHCP ACKNOWLEDGE response with crafted options like DNS and default route that is useful for the attacker to perform man-in-the-middle attacks.

DHCP starvation attack is a kind of a DoS attack performed against the DHCP server. The attacker sends many forged DISCOVERY/REQUEST packets with forged MAC addresses, quickly exhausting the DHCP server of available IP pool.

It is often useful (for the attacker) to perform a DHCP starvation attack before DHCP spoofing, so that the real DHCP server will be unable to respond to requests.

5) For an adversary looking to perform MITM, which DHCP configuration option(s) would you try to manipulate?

The 2 most useful options are DNS (to perform DNS spoofing) and default gateway IP address (to perform full MITM).

6) Briefly explain how "DHCP snooping" configuration in a switch work to prevent DHCP spoofing?

DHCP Snooping is a configuration on a Layer 3 switch that specifies the MAC address of the trusted DHCP server and the physical switchport it's connected to, and drops any forged DHCP packets. In a network where DHCP snooping is enabled, the attacker's spoofed packets are simply dropped, as it is not connected to the trusted switchport.

2. (2 points) DHCP Attack 2

1. In your VirtualBox, change the Network setting to Mode = Allow Any on both Kali and DSL.

Promiscuous

2. Run Wireshark on Kali (on eth0) and restart DSL 3. Capture the 4x DHCP messages between DSL and DHCP server (10.0.2.3) on Wireshark and take a screenshot.

4. Repeat while simulating a switched network (set Promiscuous Mode = Deny) and capture the 2x DHCP messages. You should not need to reboot Kali after changing the network settings, but you do need to reboot DSL to refresh DHCP. With Virtual Box's virtual DHCP server and, the same result is obtained. The attacker always see all 4 messages.

3. (3 points) DHCP Attack 3

1. Keep Wireshark running on Kali.

2. Use Ettercap's DHCP spoofing function to demonstrate how you can supply the victim (DSL) with a rogue DNS server, to make it easy for the attacker to spoof DNS replies. Try to perform DHCP spoofing to inject DNS server of 1.2.3.4.

3. Reboot DSL and confirm that DNS has been poisoned by looking at /etc/resolv.conf. Take a screenshot (do cat /etc/resolv.conf).

4. Go to Wireshark, and identify the REAL DHCP ACK (coming from the 10.0.2.3 MAC address) and FAKE DHCP ACK (from the Kali MAC address) being sent to DSL. Take a screenshot.

Ettercap:

Restarting DSL gives it fake DNS address in /etc/resolv.conf

Wireshark has recorded the real and fake ACK as follows. You can see that the fake one has beaten the legit one.

4. (2 point) MITM Prevention

1) Briefly explain (1 or 2 sentences max) how HTTPS can defeat MITM via ARP cache poisoning.

HTTPS (1) verifies the authenticity of the server through inspection of the server certificate by verifying it using trusted CA's root certificate (2) encrypts traffic end-to-end so that the attacker doing MITM cannot decrypt the traffic.

2) In the same context, why did Chrome developers decided to display "Not Secure" on HTTP websites?

In the absence of secure HTTPS, the victim is unable to tell if their traffic has been captured and/or altered.

3) In the same context, what's the danger of ignoring a browser error message like this one and clicking on "Continue to this website"?

SSL error may mean that there is an attacker performing MITM and/or faking a website. Since the attacker is unable to present a SSL certificate issued by a trusted CA that matches the host name, they can only present the client with a fake SSL cert giving cause to the error message.

Ignoring this kind of error can be very dangerous.

4) Briefly write an explanation that you might provide to your grandparent (or anyone who may not be IT savvy) why they should be

careful when connecting to open WiFi hotspots like the ones at airports.

Open WiFi hotspots are like toilets without walls. There is no privacy. Everyone can possibly watch see what everyone else is doing, so you should avoid it in the first instance if possible. If you must use it, make sure you are seeing the "Secure" icon on your browser next to the address bar, because that means the browser is creating a secure tunnel between you and the server.

Q5:

Method 2: Use Command: curl –user-agent “Unicorn-Browser”http://10.xx.x.x/agent.php Q6:

Q7:

Q8:

Q9:

Q10:

Q11:

Sqlmap -u “http://10.xx.x.x/guess.php”--data=”number=1”-T secret –dump

Q12:

Q13:

Q14: