What’s SYN?

You are probably aware of SYN, which stands for synchronize but here’s a quick recap of what it is. So, every time your browser requests for a web page from the web server, they must establish a connection between each other. So they just shake hands, verify themselves and set up a connection i.e. they follow the TCP 3-way Handshake mechanism.

Your machine sends the first message — SYN which is TCP packet along with a sequence number, let’s say m. Once the server receives it, it replies with a SYN + ACK packet acknowledging the received message. Along with this, it tags along its sequence number and the ack number which is the next expected sequence number from the client. The ack number is simply computed by adding the previous sequence number and the received packet’s size. Now, if the ack is verified, the client replies with ACK and sends its ack number along with it. If the ack sent is verified, the server starts the actual data transfer. The connection stays open till the FIN packets are exchanged.

Server’s side of the story

Here’s what happens at the server during this handshake process. When client sends the first SYN, a half open connection is established. Meanwhile, the server process adds this request in the TCB queue. TCP keeps information regarding each of the requests in TCB — Transmission Control Block, a complex data structure which stores the socket numbers, buffers, sequence numbers and the current segment. Only once the server receives the ACK, it dequeues the entry from TCB making space for new requests while converting the half open connection to a fully established connection.

Now, what is the attack and how it is carried on?

SYN flood is basically as DoS / DDoS attack on the server. The attacker floods the server with SYN packets making the server unresponsive. So the attacker sends multiple SYN requests to the server. The server stores the request in the TCB and establishes a half open connection, filling up the whole TCB queue. It replies with SYN + ACKs to all the SYN requests. But, the attacker machine doesn’t reply back with the ACK message. So the server won’t be able to empty it’s TCB queue and is stuck in the half open connection state as the confirmation for the client is still not received. So, this blocks the TCB queue completely and puts the server in a state where it can not accept any more SYN packets from legitimate users thus making the server completely unresponsive. This is how the server ends up in a Denial of Service state.

But, with the usage of firewalls this could be avoided for a while as the firewall blocked the IPs which sends continuous SYN requests in high numbers. However, attackers started using the DDos technique — Distributed Denial of Service i.e. they use multiple machines or just multiple IPs to send the SYN. This way the firewall will not be able to block those IPs, thinking they are legitimate requests.

Countermeasures or Recovery?

Fixing the server after the attack is only possible if the attackers send their ACK responses thus emptying the queue or if the server is reachable, RST packet can be sent where the whole TCB queue will be dropped. However, there are quite a few prevention methods available.

Using SYN cookies is a prevention method where the server computes H the SYN cookie after receiving SYN. This time the request is still not accommodated in the TCB queue. Now, the server responds with this specially crafted SYN + ACK message. Only when the client responds with an ACK packet, the server reveals the SYN cookie and verifies if the received value is valid. This is then reused to construct the TCB record.

But here’s the hitch, if the attacker is capable of spoofing SYN packets, he can easily spoof the ACK packets as well. In order to mitigate that, the server waits until the ACK before allocating resources. So only if the valid packet is received in time, the resources are allocated.

That’s not all, the attacker can flood with ACK packets and the server considers it to be valid and makes it a fully open connection and allocates resources.

Here’s what the server does now. Instead of using a random sequence number, the server computes a secret hash value keyed from the information in the packet received thus minimizing the risk.

To prevent this, you can just turn on the SYN cookie countermeasure on your Linux machine with the following command,

sudo sysctl -w net.ipv4.tcp_syncookies = 1

That’s pretty much about the TCP SYN Flood Attack, the process and its mitigation techniques.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!

We all know that when we type a URL in the browser, it sends an HTTP request to the web server requesting the required page. The server in turn returns the page, if available and the browser finally displays it. Only, it’s not this simple, there is a lot more happening behind this simple web request. Let’s find out what actually happens!

DHCP — Identify yourself

You just joined the network, your machine needs an IP address to be identified in the network. The OS broadcasts out a DHCP request with multiple layers of encapsulation — UDP, IP and then Ethernet with destination IP 255.255.255.255 and MAC FF:FF:FF:FF:FF:FF and source IP 0.0.0.0 and source MAC as the client’s MAC.

The router broadcasts this request to all the devices in the network. Once the DHCP server receives the request, it allocates an IP to the machine and sends the ACK message containing the new IP, default gateway, IP of the DNS and the subnet mask.

ARP — Where do I send my requests?

Before resolving the URL, the machine must identify it’s gateway router’s MAC, it is aware of only the IP address from the DHCP reply. So, the machine constructs an ARP request destined to the router’s IP. This request is encapsulated in an Ethernet frame, broadcasted to FF:FF:FF:FF:FF:FF MAC address.

So the switch broadcasts this request throughout and once the gateway router receives it and matches the IP, replies with its MAC.

DNS — The machines do not recognize URLs

Now that the machine has the MAC address ready, it can start with the next step. The URL entered must be resolved into IP. If browser can find the URL’s record in the local DNS i.e. the DNS cache, it directly takes the IP from there, else it reaches out to the DNS server.

So the machine encapsulates the DNS request in UDP then further in Ethernet. The first hop router / the gateway router decapsulates the frame and extracts the IP. Using the forwarding table, the destination MAC i.e. of the DNS server is determined. The DNS query is forwarded to the DNS server.

From here on, the server handles the URL resolution by looking up its root, TLD and Name servers. If found, it includes the IP for the domain in the response as well as caches the results for further use. It sends back the reply encapsulated in UDP segment and then in Ethernet frame. Once the client machine receives the message, it decapsulates it and extracts the web server IP.

TCP — Establish connection with a handshake

The next step is establishing connection with the web server. First the client creates a TCP socket. Post this, it starts the TCP 3 way handshake. First, the client sends a SYN message with a segment and sequence number to server informing it that the clients wants to open a connection. The server then replies with SYN + ACK, acknowledging the connection request and includes the expected sequence number in the reply. Then finally, the client sends ACK acknowledging the server’s reply and sends the sequence number as well as the next sequence number expected from the server. The connection is now established and the actual data transfer begins now.

HTTP — You can now send your request

Finally, the actual data transfer is done using HTTP / HTTPS protocol. The client sends a HTTP GET request to retrieve data from the web server. If the requested resources are available, the servers sends them in the HTTP response. Typical resources shared via HTTP include, webpages — text/ html files, photos, videos, etc. Other resources are shared using different application layer protocols and each of them have standard port numbers. HTTP uses port 80, HTTPS uses 443. FTP protocol via ports 20, 21 can be used for file transfer. SMTP for mail transfer via port 25. Remote connection can be established via TELNET and SSH through ports 23 and 22.

Tying it all together!

That is what a day in the life of a web request seems like! Starting from fetching an IP address and network details upon starting the machine, followed by getting the web server’s address and finally sending it the request to displaying the requested page on your browser.

It travels through all the OSI layers with layer by layer encapsulation while using a variety of protocols at each layer. Once it finds the server’s IP and sends the request, the server decapsulates the received message at each layer and in turn responds with the requested resources.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!

There are only two types of companies : those that have been hacked and those that will be. ~Robert Mueller (FBI Director, 2012)

Security issues can affect any company and can cause serious loss. There are new security concerns each day and it is quite important to secure the data stored and minimize the risks to ensure safety and protection. Most popular emerging threats and vulnerabilities are concerned with transparency, click jacking, middlemen issues, centralized systems and so on. Most of these can be solved using blockchain technology.

Blockchain has come a long way from a simple peer to peer network created by Satoshi Nakamoto. Satoshi described “blocks” and “chains” as a way of organizing and securing records, such that once entries had been made into a shared database, they could be proved mathematically correct and to have remain unchanged. It is a publicly accessible i.e. open digital ledger with high transparency among the users and ensures immutability of the data stored i.e. recorded transactions. Simply put, it is a trusted record keeping system. Some popular use cases include Bitcoin cryptocurrency platform, Ethereum, Hyperledger, etc. However, it is to be noted that blockchain can be used beyond cryptocurrency applications as well. The key traits of blockchain include distributed, immutability and transparency. These features differentiate this internet database from a regular centralized database. Let’s discuss each of these in detail in the forthcoming sections.

Key traits of Blockchain

This section shall dig deeper into the features of blockchain and they make it different from a usual database.

Open : The ledgers and records stored are publicly accessible to everyone on the network that means anyone can read and access the data without any permissions.

Distributed : There is no central database which records all the transaction and no central authority to control and monitor the transactions. It is a completely decentralized/ distributed platform i.e. a peer to peer network. It is managed autonomously by the peers in the network. This clearly minimizes the risks of making wrong decisions and frauds that would arise in case of a single controlling authority.

Transparent : It’s obvious by now that there is high transparency maintained among the peers. Everyone would be aware of all the transactions and data storage. So there is no scope of frauds occurring in the network as each user would have knowledge of each other’s data for example cryptocurrency balance, transaction history and so on due to the shared copy of the ledger. This clearly shows that there would be no privacy maintained, all your information would be public.

Immutable : Once the data is entered into the blocks, it can not be modified or deleted at any cost due to the cryptographic hashing that takes place. Each block has a unique hash value which is generated using the previous block’s hash value. Considering the fact that hash values are unique for each input, it is very easy to detect any changes in the data stored as the hash would change completely. Thus integrity can be ensured. Also, if any data is to be altered, a new hash has to be generated which means all its previous hashes have to be altered as well as they are all interlinked. Hence, the data is never modified and is permanent.

Verifiable : Each transaction that takes place in the network is strictly verified and validated by validators and miners. Since the data is publicly available to all, each user can verify that the transactions are legitimate and minimize errors and frauds as they are verified multiple times.

Anonymity : No user ID is shared, no peer will have true knowledge of the peers. Only details like wallet ID will be used which wouldn’t reveal anything about the user. So there won’t be any privacy concerns as your true identity is never exposed. Sometimes, this can be problematic to track down fraudsters.

This is how blockchains can be a much better solution to the current security threats and outperform the regular centralized database systems. However, there’s more to blockchain like its key components, working procedure, some security threats which are supposed to be known and shall be discussed in the forthcoming posts.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!

Bypass Authentication with Burp Suite, the First Step

This is post is for beginners to start off with burp suite with some basic attacks.

Setting up Burp Suite

Burp Suite is a cyber security tool for web application security testing which comes in professional, community and enterprise versions. We shall be using the community version in this tutorial. You can download it from here — https://portswigger.net/burp/releases/professional-community-2020-12-1?requestededition=community.

Post installation, the first window would look like the following. Click ‘Next’ and ‘Start Burp’ in the next window to get started. Go to the ‘Proxy’ tab and choose ‘Intercept’ and select ‘Open Browser’. A chromium browser will pop up, as an alternative you can use any other browser by setting up proxy.

Bypassing authentication

Accessing the system without using the right credentials to identify the legitimacy of users is bypassing authentication via various techniques like SQL injection, retrieving credentials, brute forcing login page and more. We shall look into some techniques to test for broken authentication in order to bypass the initial security measure. In this tutorial we will be using the test website http://demo.testfire.net/.

To begin the attacks, turn on the intercept option reading ‘Intercept is ON’ as shown in the following figure. Next step is to enter the URL in the browser, the page would not load as the intercept is on.

Click the ‘Forward’ button to load the page in the browser and the HTTP request would appear as below. So each time we click forward button, the request would be forwarded to the server.

To perform attacks for authentication bypass switch to the ‘Intruder’ tab and choose ‘positions’. Ensure the ‘$’ symbol is placed before and after the fields you want to try the attack on. After enclosing the required attribute with ‘$’ in the positions section, go to ‘payloads’ where the possible words for that attribute are provided. Set payload set to the number of selected attributes. Choose an option from the dropdown for payload type. Some common choices are simple list where a list of all the possible words in a list format, brute forcer checks for all possible words and no inputs are needed and so on. So the payload type with required inputs are to be given for each payload set. Once all inputs are given start the attack.

Let’s understand all the possible attacks to test for broken authentication in the following sections.

Sniper Attack

Let’s begin with the first attack. A sniper attack is performed to find one of the attributes provided one of the attributes is known with a payload of a single list of all possible words. Choose ‘sniper’ option from the attack type dropdown in positions page. As per the following figure, we are running the attack on the attribute passw i.e password so we can give a simple list of possible passwords. It is to be noted that the username and password for this test website is admin, so we can just make a small list which includes that for trial. In the end, the correct attribute value is where the length field has a different value since the request is accepted and the server returns the required page so content length increases.

Cluster Bomb

Cluster Bomb attack is where both username and password are found out using 2 lists of possible words as payload, we can have 2 or more payload sets here. Similar to the previous one, we can give 2 lists of possible user names and passwords, pick the set with different length value from the output window.

Battering RAM

Battering ram attack on the login page using only list as payload, to find username and password by matching corresponding words. The process is simple, it picks a value from the list and applies it to both username and password. So this attack can be useful where same input is to be inserted for multiple attributes within the request.

There are numerous methods and attacks to test for broken authentication, a few discussed above. I hope this was useful to start off with Burp Suite and get deeper in the forthcoming posts.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!

The Open System Interconnection model is a conceptual/ reference model, created by the International Organization for Standardization. The purpose of OSI is to standardize the communication between computing systems using the standard protocols. In simple words, it provides standard protocols for 2 systems to be able to be able to communicate successfully.

The model follows a layered architecture, segregating the data flow into 7 abstraction layers which shall be discussed in detail in the upcoming sections. The lower layers, from network to physical layers are known as media layers or network support layers, the other layers including the transport layer are the host layers and the top 3 layers are the user support layers.

Application layer

Starting from the top, at layer 7 we have the application layer which is the human-computer interaction layer, supporting the access of network services. The communication is initiated at this layer which directly interacts with the data received from users via the user interface web browsers and email clients, the programs running on the end systems. This layer deals with the protocols related to message syntax and semantics and similar data manipulation, which the software relies on. Some of the protocols are Hyper Text Transfer Protocol(HTTP), File Transfer Protocol(FTP), Simple Mail Transfer Protocol(SMTP), Domain Name System(DNS), Simple Network Management Protocol(SNMP) and Dynamic Host Configuration Protocol(DHCP).

Presentation layer

Following the application layer is the presentation layer at layer 6. The key functions are encryption, compression and representation of data. The presentation layer encrypts data at the sender’s end during the communication process to ensure safety and integrity of the data and decrypts at the receiver end, end to end encrypted data. Data compression is also performed by this layer for fast message delivery and improve efficiency. Layer 6 is also responsible for the translation, necessary when the 2 systems are using different standards. Implemented if required.

Session layer

The session layer is at layer 5 of the model which handles session synchronization, checkpointing and recovery of data exchange. A session is simply the time between opening and closing the connection. So this layer takes care that session is alive for the right amount of time and ends once the connection closes. Implemented if required.

Transport layer

The transport protocols are implemented at layer 4, the transport layer. As the name suggests, it takes care of the process-process data transfer which is, end to end communication between two processes. The sender breaks the messages received from the previous layers inti segments and passes to the network layer. At the receiver end, the segments are reassembled to form the original message and passes to the application layer. The additional functions the transport layer is responsible are flow control, congestion control, error control and reliable data transfer. The 2 protocols used in this layer are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).

Network layer

Layer 3 handles the 2 main functionalities at the network layer routing and forwarding the packets from source to destination based on the IP address. Packets are the small chunks of segments. Routing is finding the best physical route for the overall communication while forwarding is determining the best path at a point. The protocols are Internet Protocol (IPv4 / IPv6), Internet Control Message protocol (ICMP), Internet Group Management Protocol (IGMP) and so on.

Data Link layer

At layer 2 we have the data link layer which transfers the data frames between neighboring network elements in the same network. Frames are the small chunks generated from packets. It is also responsible for error and flow control. Then how is it different from transport layer? Transport layer handles inter network communication with error and flow control while link layer takes care of the intra network communication with error and flow control. This layer uses MAC and LLC physical addressing. Some of the protocols include Point to Point Protocol (PPP), Link Access Procedure (LAP), Synchronous Data Link Protocol (SDLC).

Physical layer

The bottom most layer of the model, layer 1 is the physical layer for binary bit transmission. This layer typically deals with the physical media used for data transfer like cables and switches using signal convention in traditional media.

Communication in the protocol stack

If Alice has to send a message to Bella, Alice’s web browser passes the message to the application layer. The application layer chooses a protocol and sends to the presentation layer. The encrypted and compressed message is sent to the session layer which will begin the session. Now, the data reaches the transport layer and broken down into segments and which are passed on using either TCP or UDP. The segments are further broken down into packets at the network layer where the packets are routed based on requirements and the destination IP address. The packets are now split into frames at the data link layer. Finally, it is passed onto the physical layer where it is simplified into bits and transferred via the physical media to the next network element. This whole process is known as encapsulation which occurs at the source.

Once the binary data reaches Bella’s system’s physical layer reassembled into frames, they flow upwards to the link layer where they are reassembled as packets. These packets flow up to the network layer and combined to get the segments which are then sent to the transport layer and combined to get back the original message. The original message goes up the session layer where the session is closed and then the presentation layer which decrypts the message. This message is finally sent to Bella’s browser via the application layer. This is decapsulation which occurs at the destination. Now Bella will be able to read Alice’s message.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!

Cryptography deals with the techniques involved in securing data from third parties known as adversaries using sophisticated mathematical equations. The key idea behind cryptography is to ensure safe and secure transmission of messages over insecure channels without the messages falling prey to eavesdropper. This is achieved by encoding the messages that is scrambling the text with a key known only to sender and recipient and making it difficult for the adversaries to understand the message. Cryptography has numerous applications in today’s world, some of them are email transmission, secure web browsing, digital currency, ATM cash withdrawal and simple message transmission. The scope of cryptography is vast, even the simplest of applications use cryptography to ensure secure data transfer.

Modern cryptography abides by the core principles — Authentication, Data Confidentiality, Data Integrity and Non-repudiation.

Fundamentals

Plain text : The original unencrypted message from the sender.

Cipher text : The encoded version of plain text the recipient receives also known as encrypted text.

Key : Randomly generated values to perform encryption and decryption of plain text and cipher text respectively. A unique key is generated via an algorithm Gen each time to make the prediction of key dubious for the intruder. The key size varies with the cipher.

Encryption : The process of encoding information and converting to an unreadable format is encryption. Several algorithms Enc are available which perform encryption in their own way with their own set of rules to scramble the data with the help of a key.

Decryption : Conversion of cipher text back to the original readable form, plain text using an algorithm Dec and key.

Cipher : The underlying algorithm which defines a procedure to perform encryption and decryption. Caesar cipher, Playfair, Vigenere, transposition and substitution ciphers are some of the classical ciphers which simply require reordering of text, swapping letters or replacing letters based on the key. Modern day ciphers are classified into stream and block ciphers. Popular ciphers are Feistal cipher, Rijndael and more.

Cryptographic algorithms classification

Symmetric Key Cryptography : Also known as private key cryptography. These algorithms use only 1 secret for both encryption and decryption. The sender and receiver share the same key, receiver uses the same key the sender uses to encrypt the plain text. No one except the 2 parties know the key, it is private to the channel. AES, DES, IDEA, BlowFish are some frequently used private key encryption algorithms.

Considering plain text as ‘m’ belongs to {0,1}, key k and ciphertext ‘c’, the encryption and decryption schemes are as follows

Enc k (m) = c; Dec k (c) = m

Dec k ( Enc k (m)) = m

Asymmetric Key Cryptography : Also known as public key cryptography. These algorithms use 2 keys, one for encryption and the other for decryption. The sender uses an encryption key which is public to all but, it can not be used to decrypt the ciphertext. The receiver uses a private key, known to none but the receiver to obtain the plain text from the encrypted text. So the public key locks and private key unlocks. This method fixes the symmetric key crypto systems’ problem of sharing the secret key over insecure channels. RSA, Diffie Hellman, El Gamal and DSA are some frequently used public key encryption algorithms.

Considering plain text as ‘m’ belongs to {0,1} , ciphertext ‘c’, public key pk and secret key k, the encryption and decryption schemes are as follows

Enc pk (m) = c; Dec sk (c)= m

Dec sk ( Enc pk (m)) = m

Cryptanalysis

The study and analysis of information to break ciphers and decrypt cipher text, breaching the crypto systems. Some basic cryptanalysis attacks,

Ciphertext only attack : The attacker has one or more ciphertext instances but has no information regarding the plain text or cipher.

Known plaintext attack : The intruder has access to some part or full plaintext. The aim of this attack to obtain the key with the analysis of the plaintext. This key can be used to further decrypt messages encrypted with the same key. So it is advisable to use a unique key for each instance.

Chosen plaintext attack : The attacker either knows the cipher or has access to the device, so feeds a plaintext message and uses the output encrypted text to find out the key.

Chosen ciphertext attack : The attacker has access to the decryption algorithm and analyzes the decryptions of the cipher text to gain insights on the key.

Thanks for stopping by this article and I really hope you did find out something new and useful today 😊!

Have fun learning. See you next time! Until then check out my other stories at AskPranaviSree.

Byee!