Downloaded 1,893 times
![Cross-Site Scripting DefensesRemove from user input all characters that are meaningful in scripting languages:=<>"'();You must do this filtering on the server sideYou cannot do this filtering using Javascript on the client, because the attacker can get around such filteringMore generally, on the server-side, your application must filter user input to remove: Quotes of all kinds (', ", and `) Semicolons (;), Asterisks (*), Percents (%), Underscores (_)Other shell/scripting metacharacters (=&\|*?~<>^()[]{}$\n\r )Your best bet – define characters that are ok (alpha and numeric), and filter everything else out](https://image.slidesharecdn.com/presentationis-110819093327-phpapp01/85/Different-types-of-attacks-in-internet-23-320.jpg)
![Cross-Site Scripting DefensesRemove from user input all characters that are meaningful in scripting languages:=<>"'();You must do this filtering on the server sideYou cannot do this filtering using Javascript on the client, because the attacker can get around such filteringMore generally, on the server-side, your application must filter user input to remove: Quotes of all kinds (', ", and `) Semicolons (;), Asterisks (*), Percents (%), Underscores (_)Other shell/scripting metacharacters (=&\|*?~<>^()[]{}$\n\r )Your best bet – define characters that are ok (alpha and numeric), and filter everything else out](https://image.slidesharecdn.com/presentationis-110819093327-phpapp01/75/Different-types-of-attacks-in-internet-23-2048.jpg)
Uploaded byRohan Bharadwaj
Different types of attacks in internet
The document provides an overview of various types of attacks in information security, including cryptographic attacks, phishing, denial of service (DoS), and malware. It explains the mechanisms behind these attacks, such as password guessing, man-in-the-middle attacks, and cross-site scripting, as well as their consequences and methods of prevention. The document stresses the importance of security measures like filtering user input and using antivirus software to mitigate these threats.
In this document
Powered by AI
Discusses various types of attacks in information security including cryptographic, injection, privilege escalation, phishing, DoS, spoofing, and malware.
Explains password guessing attacks including brute force, and dictionary attacks aimed at obtaining user credentials.
Details the Man-in-the-Middle (MITM) attack, its mechanics, tools, and the risks associated with HTTP protocol vulnerabilities.
Describes Cross-Site Scripting attack methods, mechanisms to execute the script, and user vulnerabilities that can be exploited.
Defines phishing, its history, and evolution alongside statistics illustrating its effectiveness and the various forms it can take.
Guidelines on identifying fraudulent phishing emails to avoid falling victim to scams and how the URLs can be deceptive.
Advises methods to protect against phishing, emphasizing secure practices and vigilance.
Defines DoS attacks, their consequences, and specifics about various attack types such as SYN flooding and PING floods.
Explains the mechanisms of specific DoS attacks: Ping of Death, Teardrop attacks, and Smurf attacks.Discusses spoofing methods which involve forging identities to mislead users and hide the attacker's true source.Introduces various types of malware including back doors, viruses, worms, Trojans, spyware, and adware. Also covers prevention methods.
Summarizes key cybersecurity practices and opens floor for audience questions.
More Related Content
Similar to Different types of attacks in internet
Different types of attacks in internet
- 1. Different Types ofAttacksInformation Security
- 2.
- 3.
- 4.
- 5.
- 6. AttackAct or actionthat exploits vulnerability in controlled system.Vulnerability-An information security "vulnerability" is a mistake in software that can be directly used by a hacker to gain access to a system or network.
- 7. Types of attacksCryptographicAttacksInjection AttacksPrivilege esclationPhishingDoSSpoofingMalwares
- 8.
- 9. Password guessing attackunauthorizeduser repeatedly tries to log on to a computer or network by guessing usernames and passwords.
- 10. Brute force attackBruteforce attack is a type of password guessing attack. In this type of attack, attackers systematically try every conceivable combination to find out the password of a user.Password guessing programDownload link :http://portswigger.net/burp/help/intruder.html
- 11. Dictionary attackThis typeof attack uses a dictionary of common words to find out the password of a user. It can also use common words in either upper or lower case to find a password. There are many programs available on the Internet to automate and execute dictionary attacks.
- 12. Man in themiddle attackoccur when an attacker successfully inserts an intermediary software or program between two communicating systems.
- 13. Man in themiddle attack(contd..)The MITM attack is very effective because of the nature of the http protocol and data transfer which are all ASCII based. It’s possible to capture a session cookie reading the http header, but it’s also possible to change an amount of money transaction inside the application context,
- 14. Man in themiddle attack(contd..)
- 15. MITM Attack tools There are several tools to realize a MITM attack. These tools are particularly efficient in LAN network environments, because they implement extra functionalities, like the arp spoof capabilities that permit the interception of communication between hosts. PacketCreatorEttercapDsniffCain e Abel
- 16. Cross-Site Scripting ina NutshellConsider a web site that gathers user input User input is displayed back to userValidate address, search results, etc.Attacker crafts URL with a script in it and sends to victimVictim clicks on linkScript in the URL is sent to server as user inputUser input displayed; script "reflected" back to clientScript runs on clientWhich state do I live in? I am a resident of:<SCRIPT LANGUAGE=Javascript>alert ("You are vulnerable to cross-site scripting!");</SCRIPT>
- 17. Cross-Site Scripting OverviewAttackerintends to obtain sensitive data from victim user that is only accessible from within a valid session with the target siteAttacker has analyzed the target site and identified a vulnerable CGI script (one that does not properly filter user supplied input, such as HTML <SCRIPT> tags)The site displays back to the user something the user types in, such as a name, account number, or anything, reallyAttacker has written a specialized browser script (most likely in JavaScript) that performs an action as a victim user on the target site
- 18. Ways of LaunchingCross-Site Scripting AttacksAttacker's script must be sent to the victimInter-user communication within the target site (i.e., message board, etc.)URL provided on a third-party web site (either clicked on by victim user or automatically loaded when visiting a malicious web site)URL embedded in an email or newsgroup posting
- 19. How Cross-Site ScriptingAttacks WorkVictim logs into the target siteCould occur through social engineering by attacker
- 20. Log in toyour account to get this special offer!!!2) Victim then clicks on a URL or visits a web site that includes the malicious code3) Victim user’s browser transmits malicious code to the vulnerable script on the target site as a web request4) Target site reflects the malicious code back to the victim user’s browser in the response to the request5) Malicious code executes within victim user’s browser under the security context of the target site
- 21. How It Works(continued)
- 22. When Will TheAttack Be Successful?User must be convinced to click on a URL or visit a malicious web site ANDUser must be currently logged into the target site and have a valid session (that has not timed out)Both conditions can be accomplished through social engineering via e-mail or telephone
- 23. Cross-Site Scripting DefensesRemovefrom user input all characters that are meaningful in scripting languages:=<>"'();You must do this filtering on the server sideYou cannot do this filtering using Javascript on the client, because the attacker can get around such filteringMore generally, on the server-side, your application must filter user input to remove: Quotes of all kinds (', ", and `) Semicolons (;), Asterisks (*), Percents (%), Underscores (_)Other shell/scripting metacharacters (=&\|*?~<>^()[]{}$\n\r )Your best bet – define characters that are ok (alpha and numeric), and filter everything else out
- 24. PART - IIPhishingDoSattackSpoofingBy RohanBharadwaj
- 25. PhishingPhishing is atype of deception designed to steal your valuable personal data, such as credit card numbers, passwords, account data, or other information.Con artists might send millions of fraudulent e-mail messages that appear to come from Web sites you trust, like your bank or credit card company, and request that you provide personal information.
- 26. History of PhishingPhreaking+ Fishing = PhishingPhreaking = Experiment with telecommunication networks in 70’sFishing = Use bait to lure the targetPhishing in 1995 Target: AOL users Purpose: getting account passwords for free time Threat level: low Techniques: Similar names ( www.ao1.com for www.aol.com ), social engineeringPhishing in 2001 Target: Ebayers and major banks Purpose: getting credit card numbers, accounts Threat level: medium Techniques: Same in 1995, keyloggerPhishing in 2007 Target: Paypal, banks, ebay Purpose: bank accounts Threat level: high Techniques: browser vulnerabilities, link obfuscation
- 27. A bad dayphishin’, beats a good day workin’2,000,000 emails are sent
- 28. 5% getto the end user – 100,000 (APWG)
- 29. 5% clickon the phishing link – 5,000 (APWG)
- 30. 2% enterdata into the phishing site –100 (Gartner)
- 31. $1,200 fromeach person who enters data (FTC)
- 32. Potential reward:$120,000In 2005 David Levi made over $360,000 from 160 people using an eBay Phishing scam
- 33. Spear-Phishing: ImprovedTarget SelectionSocially aware attacks
- 34. Mine social relationshipsfrom public data
- 35. Phishing email appearsto arrive from someone known to the victim
- 36. Use spoofedidentity of trusted organization to gain trust
- 37. Urge victimsto update or validate their account
- 38. Threaten toterminate the account if the victims not reply
- 39. Use giftor bonus as a bait
- 40.
- 41.
- 42. “Your bid oneBay has won!”
- 43. “The books onyour Amazon wish list are on sale!”
- 44. How To TellIf An E-mail Message is FraudulentHere are a few phrases to look for if you think an e-mail message is a phishing scam. "Verify your account." Businesses should not ask you to send passwords, login names, Social Security numbers, or other personal information through e-mail. If you receive an e-mail from anyone asking you to update your credit card information, do not respond: this is a phishing scam.
- 45. "If youdon't respond within 48 hours, your account will be closed." These messages convey a sense of urgency so that you'll respond immediately without thinking. Phishing e-mail might even claim that your response is required because your account might have been compromised.How To Tell If An E-mail Message is Fraudulent (cont’d) "Dear Valued Customer." Phishing e-mail messages are usually sent out in bulk and often do not contain your first or last name.
- 46. "Click thelink below to gain access to your account." HTML-formatted messages can contain links or forms that you can fill out just as you'd fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company's name and are usually "masked," meaning that the link you see does not take you to that address but somewhere different, usually a phony Web site. How To Tell If An E-mail Message is Fraudulent (cont’d)Con artists also use Uniform Resource Locators (URLs) that resemble the name of a well-known company but are slightly altered by adding, omitting, or transposing letters. For example, the URL "www.microsoft.com" could appear instead as: www.micosoft.com www.mircosoft.com www.verify-microsoft.com
- 47. Never respondto an email asking for personal information
- 48. Always checkthe site to see if it is secure. Call the phone number if necessary
- 49. Never clickon the link on the email. Retype the address in a new window
- 50. Keep yourbrowser updated
- 51. Keep antivirusdefinitions updated
- 52. Use afirewallDoS attackIt is also known as “network saturation attack” or “bandwidth consumption attack”.Attackers make Denial-of-Service attacks by sending a large number of protocol packets to a network.
- 53. Consequences of DoSSaturatenetwork resources. Disrupt connections between two computers, thereby preventing communication between services.Disrupt services to a specific computer.
- 54. Common DoS AttacksSYNattackPING floodPing of deathTeardrop attackSmurf attack
- 55. SYN attack/SYN floodingASYN attack affects computers running on the TCP/IP protocol.an attacker sends multiple SYN packets to the target computer. For each SYN packet received, the target computer allocates resources and sends an acknowledgement (SYN-ACK) to the source IP address. Since the target computer does not receive a response from the attacking computer, it attempts to resend the SYN-ACK. This leaves TCP ports in a half-open state. When an attacker sends TCP SYNs repeatedly, the target computer eventually runs out of resources and is unable to handle any more connections, thereby denying services to legitimate users.
- 56. Diagram showins SYNflood
- 57. PING flood It relieson the ICMP echo command, more popularly known as ping . In legitimate situations the ping command is used by network administrators to test connectivity between two computers. In the ping flood attack, it is used to flood large amounts of data packets to the victim’s computer in an attempt to overload it.
- 58.
- 59. Ping of deathThemaximum size for a packet is 65,535 bytes. If one were to send a packet larger than that, the receiving computer would ultimately crash from confusion.Sending a ping of this size is against the rules of the TCP/IP protocol, but hackers can bypass this by cleverly sending the packets in fragments. When the fragments are assembled on the receiving computer, the overall packet size is too great. This will cause a buffer overlflow and crash the device.
- 60.
- 61. Software to pingattackDownload Link:-http://www.softpedia.com/progScreenshots/AtTacK-PiNG-Screenshot-80794.html
- 62. Teardrop attackTeardrop attacksexploit the reassembly of fragmented IP packets. Fragment offset indicates the starting position of the data contained in a fragmented packet relative to the data of the original unfragmented packet.
- 63. Teardrop attack(contd..)When thesum of the offset and size of one fragmented packet differ from that of the next fragmented packet, the packets overlap, and the server attempting to reassemble the packet can crash, especially if it is running an older operating system that has this vulnerability.
- 64. Smurf attackThe attackersends a large amount of ICMP traffic to a broadcast address and uses a victim’s IP address as the source IP so the replies from all the devices that respond to the broadcast address will flood the victim.
- 65. SpoofingSpoofing is atechnique that makes a transmission appear to have come from an authentic source by forging the IP address. In IP spoofing, a hacker modifies packet headers by using someone else’s IP address to hide his identity.
- 66.
- 67.
- 68. Back Door Backdoor is a program or account that allows access to a system by skipping the security checks.Many vendors and developers implement back doors to save time and effort by skipping the security checks while troubleshooting.Back door is considered to be a security threat and should be kept with the highest security.If a back door becomes known to attackers and malicious users, they can use it to exploit the system.
- 69. Backdoor is asecret or unauthorized channel for accessing computer system. In an attack scenario, hackers install backdoors on a machine, once compromised, to access it in an easier manner at later times
- 70. VirusDefinitionA virus isa small piece of software that piggybacks on real programs in order to get executedOnce it’s running, it spreads by inserting copies of itself into other executable code or documents
- 71. Computer Virus Timeline1949 Theories for self-replicating programs are first developed.-John von Newmann.1981 Apple Viruses 1, 2, and 3 are some of the first viruses “in the world,” or in the public domain. Found on the Apple II operating system, the viruses spread through Texas A&M via pirated computer games.1983 Fred Cohen, while working on his dissertation, formally defines a computer virus as “a computer program that can affect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself.”1986 Two programmers named Basit and Amjad replace the executable code in the boot sector of a floppy disk with their own code designed to infect each 360kb floppy accessed on any drive. Infected floppies had “© Brain” for a volume label.1987 The Lehigh virus, one of the first file viruses, infects command.com files.1988 One of the most common viruses, Jerusalem, is unleashed. Activated every Friday the 13th, the virus affects both .exe and .com files and deletes any programs run on that day.MacMag and the Scores virus cause the first major Macintosh outbreaks.…
- 72. General virus typesWhilethere are thousands of variations of viruses, most fall into one of following generl categories, each of which works slightly differently.Boot sector virusMacro virusMultipartite virusPolymorphic virusStealth virusE-mail viruses
- 73. Boot Virus :Replaces or implants itself in the boot sector. This kind of virus can prevent you frombeing able to boot your hard disk.Macro Virus : Written using a simple macro programming language,these viruses affect Microsoft Office applicationssuch as word and excel. A document infected with a macro virus generally modifies a pre-existing, common command(such as save) to triggerto trigger its payload upon execution of that command.
- 74. Multiparatite Virus :Infectsboth files and boot sector--a double whammy that can reinfect your system dozen times before it's caught.Polymorphic Virus :Changes code whenever it passes to another machine
- 75. Stealth Virus: Hides in presence by making an infected file not appear infected.E-mail Virus : An e-mail virus moves around in e-mail messages, and usually replicates itself by automatically mailing itself dozens of people in victims e-mail address book.
- 76. Case study-Melissa VirusMarch1999 the Melissa virus was the fastest-spreading virus ever seen Someone created the virus as a Word document uploaded to an Internet newsgroupPeople who downloaded the document and opened it would trigger the virusThe virus would then send the document in an e-mail message to the first 50 people in the person's address book
- 77. Case study-Melissa VirusTookadvantage of the programming language built into Microsoft Word called VBA (Visual Basic for Applications)
- 78. PreventionUpdatesAnti-VirusesMore secure operatingsystems e.g. UNIX
- 79. WormsWorm – Aworm is a computer program that has ability to copy itself from machine to machine. Worms normally move around and infect other machines through computer networks. Worms eat up storage space and slows down the computer. But worms don’t alter or delete files.
- 80. Trojan horsesA Trojeanhorse is simply a computer program that claims to do one thing (it may claim to be a game) but instead does damage when you run it (it may erase your hard disk).When loaded onto your machine, a Trojan horse can capture information from your system.
- 81. Trojan horses(contd..)It allowsa malicious hacker to remotely control your computer.Trojan horse has no way to replicate automatically.
- 82. What is Spyware?Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge.
- 83. What is Adware?Adwareare created by advertising companiesComes in the form of popups, unexplained advertising programs on your computer desktop like “Casino Night”.Advertising companies hope to generate money from customers who receive the popups or unexplained programs on their computers.Also a LEGAL program!
- 84. ConclusionAlways use Anti-virus software.Scan external devices when connected to computer.Enable firewall.Read carefully and then click a link.
- 85.