CSNT 181 END YEAR EXAM 2025/2026
GRADED A+
(VERIFIED)
Network Attacks - A modern attacker's most valuable tool, by far the easiest way to distribute
malware and its a great vector for social engineering attack.
Classifying Network Attacks - 1. Confidentiality - violating attacks seek to access sensitive data
2. Integrity - seeks to alter information
3. Availability - seeks to impair access to the network
Categorize attack by the layer of the network being targeted - 1. Physical hardware or connection
technology of the network
2. Mid-level protocols of network appliances
3. Go directly for vulnerabilities in applications or host operating systems
Adversary Reconnaissance - Determined attacker wants to know as much as possible about
vulnerabilities before making moves - easier to know what services or protocols to attack
Attacker Progression - Start with passive OSINT then move to active network scanning and
enumeration tools.
Port Scanners - Used to find open ports with active services. Response on a port can reveal additional
information about a specific service. Send packets to a whole range of port numbers on a host,
looking to find open ports with active services.
Complex scanner tools use specialized requests than can return more information - Xmas attack - all
lit up with a combination of options never used in routine communication; uses a packet with
Urgent, Push, and FIN flags set. How a remote host responds reveals information about the network
and what ports are opened.
Fuzzing - Inserts random or invalid data into more complex header fields or application data inputs. A
way to learn how a service or application responds to non-standard input, enabling future attacks
, Banner grabbing - Gathering information from messages that a service transmits when another
program connects to it. Many services openly report their software and protocol version along with
other information
Spoofing - attacker falsifies source information to facilitate attack. Many protocols don't have any
way to authenticate source addresses so spoofing can be pretty straightforward
IP spoofing - alters the source IP address used to route packets on IP networks. Often used to
impersonate another device on the network
MAC spoofing - alters the source MAC address used to identify physical devices on local networks; it
is defined in hardware but can be changed in software
MAC cloning - a form of MAC spoofing used to impersonate another device on the same network by
copying its MAC address. MAC cloning can be used to defeat some forms of network access control.
MAC flooding - A form of MAC spoofing used to compromise the security of a network switch by
overwriting its MAC table cache. Unlike MAC cloning, it involves spoofing many different source
addresses to overwrite the switch's cache. MAC flooding can be used to assist eavesdropping or
redirection attacks
E-mail spoofing - Altering an e-mail address so that it appears to come from a person other than the
sender
Caller ID spoofing - displaying an incorrect number on the recipient's caller ID display to hide the
caller's identity
Network security devices often control traffic based on its origin - spoofing can circumvent some of
these measures - Wireless access points are commonly configured only to allow known, permitted
MAC addresses to connect.
Routers and firewalls often allow or block traffic based on source IP address - Spoof the source
address to bypass these controls.
Redirection - Divert traffic from a target sender to a location of the attacker's choosing. Goal -
eavesdropper can read traffic, force connection to malicious site. Begins with spoofing attack used to
compromise a traffic-direction component on the network
GRADED A+
(VERIFIED)
Network Attacks - A modern attacker's most valuable tool, by far the easiest way to distribute
malware and its a great vector for social engineering attack.
Classifying Network Attacks - 1. Confidentiality - violating attacks seek to access sensitive data
2. Integrity - seeks to alter information
3. Availability - seeks to impair access to the network
Categorize attack by the layer of the network being targeted - 1. Physical hardware or connection
technology of the network
2. Mid-level protocols of network appliances
3. Go directly for vulnerabilities in applications or host operating systems
Adversary Reconnaissance - Determined attacker wants to know as much as possible about
vulnerabilities before making moves - easier to know what services or protocols to attack
Attacker Progression - Start with passive OSINT then move to active network scanning and
enumeration tools.
Port Scanners - Used to find open ports with active services. Response on a port can reveal additional
information about a specific service. Send packets to a whole range of port numbers on a host,
looking to find open ports with active services.
Complex scanner tools use specialized requests than can return more information - Xmas attack - all
lit up with a combination of options never used in routine communication; uses a packet with
Urgent, Push, and FIN flags set. How a remote host responds reveals information about the network
and what ports are opened.
Fuzzing - Inserts random or invalid data into more complex header fields or application data inputs. A
way to learn how a service or application responds to non-standard input, enabling future attacks
, Banner grabbing - Gathering information from messages that a service transmits when another
program connects to it. Many services openly report their software and protocol version along with
other information
Spoofing - attacker falsifies source information to facilitate attack. Many protocols don't have any
way to authenticate source addresses so spoofing can be pretty straightforward
IP spoofing - alters the source IP address used to route packets on IP networks. Often used to
impersonate another device on the network
MAC spoofing - alters the source MAC address used to identify physical devices on local networks; it
is defined in hardware but can be changed in software
MAC cloning - a form of MAC spoofing used to impersonate another device on the same network by
copying its MAC address. MAC cloning can be used to defeat some forms of network access control.
MAC flooding - A form of MAC spoofing used to compromise the security of a network switch by
overwriting its MAC table cache. Unlike MAC cloning, it involves spoofing many different source
addresses to overwrite the switch's cache. MAC flooding can be used to assist eavesdropping or
redirection attacks
E-mail spoofing - Altering an e-mail address so that it appears to come from a person other than the
sender
Caller ID spoofing - displaying an incorrect number on the recipient's caller ID display to hide the
caller's identity
Network security devices often control traffic based on its origin - spoofing can circumvent some of
these measures - Wireless access points are commonly configured only to allow known, permitted
MAC addresses to connect.
Routers and firewalls often allow or block traffic based on source IP address - Spoof the source
address to bypass these controls.
Redirection - Divert traffic from a target sender to a location of the attacker's choosing. Goal -
eavesdropper can read traffic, force connection to malicious site. Begins with spoofing attack used to
compromise a traffic-direction component on the network
