Discovering brute-force and application attacks

The next step in network attack is to understand the various types of brute-force attacks. A brute-force attack is a trial-and-error method used to obtain information from the victim, for example, trying to find organizational servers, user directories, and crack passwords.

Getting ready

Brute-force attacks usually will not produce non-standard loads on the network, and the way they are discovered is usually by IDS systems or when there is a suspicion that someone is trying to hack into the network. In this recipe, we will learn how to identify typical brute-force attacks.

How to do it...

When you suspect a brute-force on the network, follow these steps to locate it.

  1. Connect Wireshark with port mirror to the port in the server that you suspect is under attack.
  2. For DNS brute-force attacks, look for DNS queries that are asking for common names under your domain. For example, in the following illustration, you can see a scan for ISP servers. We can see DNS queries to common names such as dns (1) and dns2—a record for IPv4 (2) and a record for IPv6 (3), and intranet—a record for IPv4 (4) and a record for IPv6 (5).
    1. In the case of dns.icomm.co (1), we got a reply; in all other cases, we did not.
    2. Many queries with no response can indicate a DNS brute attack, but also indicate someone who is looking for a server that does not exist. Look at the source address to see where it is coming from.
      How to do it...
  3. Another brute-force attack to watch out for is HTTP trying to find resources on the server.
    1. To look for HTTP scanning, look for the scanner's signature in the packet details, as seen in the following screenshot.
      How to do it...
    2. Also, look for too many HTTP error messages. Some examples are illustrated in the following screenshot. Choose Statistics | HTTP | Packet Counter | PC. If you get too many error messages, check for their source.
      How to do it...

How it works...

Brute-force attacks are trial and error attacks that send requests to the destination, hoping that some of them will be answered. Since most of these requests will be denied (if you've configured your servers properly), a large amount of Not Found messages, forbidden messages, and other error codes can be some of the syndromes for such an attack.

There's more...

For discovering HTTP error codes, configure the display filter http.response.code >= 400. The same applies to SIP and any protocol that uses HTTP-like codes. To find known scanners, you can simply use the Edit | Find packet feature and look for common scanner names. In the following screenshot, you can see an example for Nmap, which is one of the common ones. We chose the string nmap.org (1) in Packet bytes (2).

There's more...

And this is what we got:

There's more...

Another important issue is brute force attack, that is, when the attacker tries to guess the password in order to break into a server.

In the following screenshot, you'll see what happens when an attacker tries to break into a well-protected FTP server.

There's more...
  1. Since it is FTP, the first trial is with username anonymous (1), a password chosen by the attacker (2), login is, of course, approved (3), and the attacker gets in (4).
  2. In the following screenshot, you see what happens when the attacker tries other usernames that are not authorized.
    There's more...
  3. Here, you can see that the attacker is trying to login with the usernames root (1), admin (2) and administrator (3).
  4. The attacker is blocked, and the server sends a TCP Zero-Window message and even answers by saying you could at least say goodbye.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.137.217.177