C01-202
1
2
- (Masquerade) (Replay) (Message Modification) (Denial of Service)
- ( ) (Eavesdropping) (Traffic Analysis)
8 1 2 7 3 6 5 4
3
- TCP SYN (SYN flood) Smurf Ping of Death LAND Attack Teardrop
- (Worm)
- (Session Hijacking) (Replay Attack) (Buffer Overflow) (Sniffing Eavesdropping) (Social Engineering) (SQL Injection)
3
(1/2) DoS (Deny of Service) ( )
(2/2) Smurf TCP DoS: Land Teardrop TCP SYN UDP Flood DoS ICMP DoS
DDoS DoS
DDoS Daemon client client daemon daemon daemon client ICMP Echoreply Packets Internet daemon daemon
TCP SYN (SYN flood) (1/2( 1/2) (TCP) (three way handshake) HOST A Send SYN (seq=x) Receive SYN (seq=y, ACK=x+1) Receive ACK (ack=y+1) Receive SYN (seq=x) Send SYN (seq=y, ACK=x+1) Receive ACK (ack=y+1) HOST B
TCP SYN (SYN flood) (2/2( 2/2) SYN ACK SYN ACK ACK SYN
Smurf (1/2) ICMP(Internet Control Message Protocol) ICMP echo request packet. ICMP echo reply packet. ping IP Protocol ping message Internet Reply message
Smurf (2/2) Smurf Dos ICMP echo Request icmp ICMP echo reply ping -s 30000 192.168.30.255 smurf
Ping of Death Ping of Death ping (ICMP echo request) (Overflow)
LAND Attack IP IP IP From : 60.44.35.11:23 211.3.56.22 TO: 64.44.35.11:23 IP 60.44.35.11 Port 23 Open Crash
Teardrop IP IP
Ingress Filtering broadcast (Disk Quota)
3
( ) ( ) :.exe,.dll,.htm,.vbs,.js FTP Internet
(Worm)
Internet Client ( ) / Server ( )
/ / / /FTP /
3
A TCP/IP 65536 TCP UDP port. Port Scan B Port 1000,2000,3000...
IDS (banner)
3
(Brute-force attack) (Dictionary-Based attack) A!!!! B
:
3
Session Hijacking Kra 1998 11 Hunt daemon9 juggernaut Session Hijacking
Session Hijacking (mutual authentication) IPSEC SSH. A IPSEC / SSH B
3 (Replay Attack)
(Replay Attack)
3 (Buffer Overflow)
(Buffer Overflow) : #include <stdio< stdio.h> #include <string.h> void func(char *p) { char buffer1[10]; strcpy(buffer1, p); printf(buffer1); } Int main(int argc, char *argv[]) { func( I am the law in the network ); return 0; }
(local buffer overflow) (remote buffer overflow) (patches)
3
Sniffer (Promiscuous Mode), switch hub
3
:
3 (SQL Injection)
(SQL Injection) (1/2( 1/2) (SQL Injection) SQL SQLserver
(SQL Injection) (2/2) Apache IIS Domino Netscape ASP PHP JSP MS-SQL MySQL Oracle Sybase DB2 SQL Injection SQL Injection
input SQL shell command shell command return code error codes