Day3: Ethical Hacking | Basics of Networking-02 | #EthicalHacking #Cybersecurity #ai #networking
Welcome back to the AI Academy, we are excited to have you join us for our third lecture in this comprehensive ethical hacking course. Let's start with the basics of the TCP/IP model which stands for Transmission Control Protocol/Internet Protocol. It's a conceptual framework that defines how data is transmitted across interconnected networks, like the Internet. Think of it as the rules of the road for digital communication.
So, why do we need a model like TCP/IP?It is used for standardization for example, imagine you are trying to send a letter but having no universal format for addressing or delivering it. Similarly, in the digital world, devices need standardized rules to ensure data reaches its destination. The TCP/IP model provides these rules, ensuring devices, regardless of the manufacturer or software, so that they can communicate seamlessly, such as layered structure for simplicity. The TCP/IP model organizes networking into four layers, with each layer focusing on a specific aspect of communication. The application layer deals with the software and interfaces users interact with, like your web browser. The transport layer,
ensures data is delivered error-free, in the right order, and without losses, this is where protocols like TCP and UDP come in. The Internet layer, responsible for routing data packets across different networks. The network access layer, handles the physical transmission of data, like Ethernet or Wi-Fi. So, by dividing tasks into layers, the model makes networking more manageable. Each layer
works independently but complements the others, much like different departments in a company. TCP/IP model is the foundation for the Internet: every time you send an e-mail, stream a video, or make an online purchase, you're using the TCP/IP model. It's the backbone of how the Internet operates, ensuring your request from one part of the world reaches a server on the other side. To help
your understanding, let's look at a few practical scenarios for example, sending an e-mail, when you hit Send, your e-mail application, at the application layer, formats the message. The transport layer splits the e-mail into smaller packets and ensures they are numbered so they can be reassembled in order. The internet layer assigns each packet an IP address, ensuring they reach the correct recipient, even if they take different routes. Finally, the network access layer, it physically transmits the data over cables or wireless signals. If we look into another example of streaming a video on YouTube, in this case the application layer handles your request to load a video and displays the interface. The transport layer uses TCP to ensure the video data is received without corruption. The internet
layer manages routing through various servers to deliver the video from YouTube's data center to your device. The network access layer deals with your home router and ISP to transmit the data. Take one more example of browsing a website: when you type www.example.com into your browser, the application layer sends a request to the web server. The
transport layer uses TCP to break this request into manageable pieces. The Internet layer directs these pieces to the web server, ensuring they find the best path. Your computer and the web server communicate back and forth at the network access layer until the website loads. So, why should you care
about TCP/IP?The TCP/IP model isn't just a theoretical concept, it's the blueprint for almost everything we do online. As an ethical hacker or penetration tester, understanding this model helps you to identify vulnerabilities. Each layer has specific security challenges, and knowing how they function helps you pinpoint weaknesses. It
allows to simulate attacks effectively, for instance, to exploit a vulnerability in the transport layer, you need to understand how TCP and UDP operate. To defend networks better, By grasping how data flows through layers, you can implement safeguards to prevent breaches. In summary, the TCP/IP model is essential for communication in the digital world. It's like a translator that ensures devices speak the same language, no matter their differences. Whether you're sending a meme or deploying a cybersecurity defense system, you're using TCP/IP and understanding it should be your first step toward mastering ethical hacking. Let's move on to the next part, where we'll explore the layers of the TCP/IP model in more detail. The
TCP/IP model breaks down network communication into four distinct layers. Each layer has a specific role, and they work together to ensure smooth data transmission from one device to another. Let's go layer by layer. The first one is application layer where humans and software interact with each layer.
It's the topmost layer of the TCP/IP model and provides services directly to user applications. This layer handles high-level protocols, file transfers, web browsing, e-mail, and other network-related activities. It allows users to communicate with the network without worrying about the technical complexities beneath. The examples of protocols are HTTP, HTTPS, used for web browsing.
and the SMTP, IMAP, POP3, used for sending and receiving emails. The FTP and SFTP, for file transfers. The DNS protocol, converts domain names, like google.com, into IP addresses. For example, when you type a URL into your browser, the application layer uses HTTP to format the request and send it down to the lower layers for processing. The next layer is transport layer. It is
responsible for the reliable or unreliable delivery of data between devices. It acts like a mail sorter, ensuring that packets are delivered to the correct application on the receiving device. The key functions of this layer are segmentation and reassembly, splits data into smaller packets and ensures they are reassembled correctly at the destination. The error detection and recovery process, ensures reliable data transfer by retransmitting lost packets. And the port numbers, directs packets to the correct application, such as, port 80 for HTTP, port 443 for HTTPS. The protocols in this layer are TCP or Transmission Control Protocol, is connection-oriented and reliable. It
ensures all packets are delivered in the correct order and without errors. For example, it is used in file downloads and web browsing. UDP, the User Datagram Protocol is connectionless and faster but less reliable. For example, UDP is used in streaming and gaming. If you're downloading a
file, TCP ensures that every part of the file is received correctly and reassembled. For watching a live video stream, UDP prioritizes speed, even if some packets are lost. The third layer is Internet layer, it takes care of addressing and routing. It ensures that data packets find their way across networks to the correct destination, even if the devices are on opposite sides of the world. The key functions of this are like: Logical addressing, assigns unique IP addresses to devices. Routing, determines the best path for data to travel between networks. Packet
delivery,breaks data into packets and attaches the appropriate IP address for routing The protocols in this layer are IP or the Internet Protocol it handles addressing and packet routing The ICMP or the Internet Control Message protocol used for diagnostic purposes like ping command The practical example are When you visit a website, your request travels through several routersThe Internet layer ensures your request reaches the correct web server using its IP address. The fourth and last layer is network access layer, it handles the physical and hardware aspects of communication. It is the lowest layer of the TCP/IP model, directly interfacing with the network hardware. The key function of this layer includes converting data packets into electrical, optical, or radio signals for transmission. It
also manages device-specific addressing using MAC addresses, and ensures that the data frames are sent and received over the physical medium, such as Ethernet or Wi-Fi. The components of this layer are the Network Interface Card also called as, NIC a hardware component that enables devices to connect to the network. And the protocols of this are Ethernet, Wi-Fi, IEEE 802.11, and others. The practical example is
that when you connect your laptop to a Wi-Fi network, the network access layer transmits your data through the router to the ISP's infrastructure. Let's use an example of sending a message via WhatsApp to understand how the layers work together. In the application layer, you type the message and hit send. The app formats the message using an appropriate protocol, such as HTTP or custom app protocol. In the
transport layer, the message is broken into packets. If TCP is used, it ensures all packets are delivered. And in the internet layer, each packet is assigned a source and destination IP address, allowing it to traverse multiple networks. And
lastly in the network access layer, the packets are converted to signals and sent over Wi-Fi or Ethernet to the router and beyond. Each layer has its distinct responsibilities but relies on the others for a seamless communication experience. To summarize, the application layer is where we interact with browsers, e-mail, apps. The transport layer ensures reliable or fast data transfer using TCP or UDP. The Internet layer handles IP addressing and routing across networks. The Network Access layer handles physical transmission through Ethernet or Wi-Fi.
Understanding these layers not only helps us grasp how networking works but also lays the foundation for recognizing and securing vulnerabilities in each layer. Let us now compare TCP/IP model with the OSI model. The TCP/IP model and the OSI model, the both frameworks are designed to standardize and describe how data is transmitted over networks. However, they serve slightly different purposes and are structured differently. Let's explore the key differences and why TCP/IP is the more practical model in today's networks. To recall the OSI model was developed as a conceptual framework for standardizing communication protocols. It organizes a
networking into seven layers, making it very detailed and granular to understand. The layers of the OSI model are the physical layer it handles the actual transmission of raw bits over a physical medium. The data link layer it is responsible for node-to-node data transfer and error detection. Network layer it handles routing and logical addressing. Transport layer ensures reliable delivery of data.
Session layer manages sessions and connections between applications. Presentation layer deals with data formatting, encryption, and compression. Application layer provides network services to user applications.
Whereas the TCP/IP model simplifies networking into four layers. The application layer combines the OSI application, presentation, and session layers. Transport layer, same as the OSI transport layer. Internet layer, equivalent to the OSI network layer And the network access layer, combines the OSI physical and data link layers together The key differences between TCP/IP and OSI models are that TCP/IP model has 4 layers whereas OSI model has 7 layers The TCP/IP model was developed for practical implementation whereas OSI model has been developed as theoretical model for standardizationThe TCP/IP model is protocol driven whereas OSI model is concept driven. The TCP/IP has real-world use and is widely implemented for internet communication whereas OSI model is rarely implemented as a whole. The
TCP/IP model is built around standard protocols such as TCP/IP, HTTP, whereas OSI model is protocol agnostic, doesn't tie to specific ones. The TCP/IP model was developed with the practical implementation approach whereas the OSI model was developed as a theoretical model for the standardization. The TCP/IP model combines the layers for simplicity whereas OSI model layers are detailed with separate roles for each layer. The TCP/IP model is protocol-driven whereas the OSI model is concept-driven. The
TCP/IP model is widely implemented for the Internet communication whereas the OSI model is rarely implemented as whole. Let us now understand why TCP/IP is more commonly used. The first and foremost reason is the practical design, the TCP/IP model was designed for real-world implementation and interoperability between devices. It is not just a theoretical framework, it's the foundation of the Internet. For example, TCP/IP incorporates specific protocols like IP and TCP that are universally recognized and used.
Next is simplicity and efficiency, with only four layers, the TCP/IP model is easier to understand and implement. It merges overlapping responsibilities into single layers, avoiding unnecessary complexity. Next is widespread adoption, the TCP/IP became the standard because of its early adoption in ARPANET, the precursor to the modern Internet. As the Internet grew, so did the use of TCP/IP grow, making it the de facto standard for networking. The
TCP/IP has protocol-centric approach, the OSI model describes what needs to happen at each layer but doesn't define how to do it. In contrast, TCP/IP integrates specific protocols, like IP, TCP, UDP, directly into its structure. For example, while OSI theorizes about routing at the network layer, TCP/IP's internet layer uses the IP protocol for actual routing. Flexibility for modern networks, the TCP/IP model is more adaptable to modern networking technologies. Protocols like IPv6 and HTTP have seamlessly integrated into the model. The OSI model, being rigid and overly theoretical, hasn't evolved as effectively. Support for the Internet,
the TCP/IP model underpins the Internet and all its associated services, such as web browsing, e-mail, and video streaming. Its protocols, like HTTP, HTTPS, FTP, are the backbone of online communication Let's say you're streaming a video In OSI model, you'd theoretically track the video from the application layer down to the physical layer, but it doesn't specify the exact protocols involved at each stage Whereas TCP/IP model, the application layer handles the HTTP request to access the video,The transport layer ensures reliable delivery with TCP, the Internet layer routes the data using IP, and the network access layer transmits the data physically over Wi-Fi or Ethernet. In real-world use, the TCP/IP model is more straightforward and protocol-specific, making it the better choice for implementing services like video streaming. In summary, while
the OSI model is great for understanding networking concepts in detail,the TCP/IP model is more practical for implementation. Its simplicity, protocol-driven design, and adoption as the foundation of the Internet make it the standard for real-world applications. Let us now discuss about the basics of the IP protocol for better understanding of the roles and responsibilities of the various layers of the TCP/IP model. So, the IPv4,or the Internet Protocol version 4, introduced in the early days of the Internet, IPv4 is the most widely used version of IP. It uses a 32-bit addressing scheme, allowing for about 4.3 billion unique
addresses. Example of an IPv4 address is 192.168.1.1 The limitations with the IPv4 was the explosive growth of connected devices, due to which IPv4 addresses are nearly exhausted. And the second one is IPv6 which is Internet Protocol version 6, IPv6 was developed to address the limitations of IPv4.
It uses a 128-bit addressing scheme, providing trillions of unique addresses. Example of an IPv6 address is 2001:0db8:85a3:0000:0000:8a2e0370:7334. The benefits of IPv6 is better security with integrated encryption, improved performance, and sufficient capacity for future growth. An IP address uniquely identifies devices on a network. It consists of two parts. The
network ID identifies the specific network. The host ID identifies the specific device within that network. The internet layer ensures that data packets are sent to the correct destination by determining the best route. And then passing packets through intermediate devices such as routers. This is accomplished using routing tables, which contain rules for forwarding packets based on their destination IP addresses. We will discuss about the IP addressing and routing in detail in upcoming lecture from the ethical hacking perspective.
As discussed in last lecture, as a next step the packet encapsulation and decapsulation is performed. The encapsulation occurs when data from higher layers is wrapped with headers specific to the Internet layer. The Internet layer adds the IP header, which includes the source IP address from where the data originates And the destination IP address to where the data is headed And the other metadata like time to live, TTL, and protocol type, such as TCP or UDP And while in the decapsulation process, at the destination, the process is reversed The IP header is removed, and the encapsulated data is passed to the next layerThe transport layer. This process ensures that only the intended recipient processes the data. The encapsulation is performed starting from application layer data, the transport layer which adds TCP or UDP headers, and the Internet layer adds IP headers, and in the last the network access layer adds MAC address.
The fully encapsulated packet travels through routers and networks. At the destination, each layer strips its corresponding header, leaving the original application layer data The network devices in the TCP/IP ecosystem are the routers operate at the Internet layer, directing data packets between different networks They examine the destination IP address in each packet It uses routing tables and algorithms to determine the best path For example,If you're sending an e-mail to a friend overseas, the packet travels through multiple routers before reaching the recipient's mail server. The switches operate primarily at the data link layer, but indirectly it supports the Internet layer by connecting devices within the same local area network. The switches use MAC addresses to forward data frames between devices. They ensure efficient communication within the local network before packets are handed off to the router. The firewalls operate across multiple layers, including the Internet layer, to secure networks. Firewalls inspect
incoming and outgoing packets based on rules, such as, block traffic from suspicious IPs. And it prevent unauthorized access while allowing legitimate traffic. For example, a firewall can block packets from an untrusted source while allowing packets from a known website. Let us take
practical example of the Internet layer in action Let's say you're accessing a website Your request Your browser sends a request to www.example.com The Internet layer adds your IP address as the source and the web server's IP address as the destination Next is routing through routers The packet travels through multiple routers that examine the destination IP address and forward it toward the web serverAfter reaching the server, the server receives the packet, removes the IP header, and processes the request. In summary, the Internet layer is the backbone of internetwork communication, ensuring data reaches its destination through addressing, routing, and forwarding mechanisms. Understanding this layer is vital for anyone looking to master network security or ethical hacking. Next, we'll explore the transport layer and how protocols like TCP and UDP function. The transport layer in the TCP/IP model is a critical component that ensures reliable and efficient delivery of data across networks. This layer is
responsible for breaking data into packets, transmitting them, and ensuring that they are correctly reassembled on the receiving end. It serves as a bridge between the Internet layer and application layer, providing end-to-end communication. The transport layer operates between the Internet layer and application layer in the TCP/IP model. The Internet layer ensures packets are routed and delivered to the correct device based on IP addresses. The transport layer takes it a step further by managing the flow of data between applications on source and destination devices. The core functions of the
transport layer are: Segmentation, breaking large messages into smaller packets. Reassembly, combining packets back into the original message at the destination. Flow control, preventing one device from overwhelming another with data. Error checking, ensuring data integrity during transmission. Application identification, using port numbers to direct data to the correct application, such as HTTP uses port 80, HTTPS uses port 443. Why TCP and UDP are needed, so, while the Internet layer focuses on routing data between devices, it doesn't guarantee data will arrive intact, in order, or even at all. This is where
the transport layer comes in. Depending on the application,It uses either TCP or UDP to provide the appropriate level of reliability and efficiency. So, what is the importance of the transport layer for data transport reliability?The first thing is the reliability with TCP. The
TCP is a connection-oriented protocol. The TCP establishes a connection between sender and receiver before transmitting data. This is done through the three-way handshake process. The first is SYN, the sender requests to establish a connection Then the SYN ACK, the receiver acknowledges the request And in the last the ACK, the sender confirms, and the connection is established The key features of TCP are Reliable delivery, it ensures all packets are received and reassembled in the correct order If packets are lost, TCP retransmits them Error checkingIt uses checksums to verify data integrity. And the flow control, it adjusts the rate of data transfer based on the receiver's capacity to process it. The use cases for TCP are web browsing, e-mail, and file transfers. Next
is the efficiency with UDP, the UDP performs connectionless communication. Unlike TCP, UDP does not establish a connection before sending data. Packets are sent independently, and there's no guarantee of delivery, order, or error correction. The key features of UDP are: Low latency, no overhead from connection establishment or acknowledgement packets. Stateless, the sender does not track the state of the communication. Unreliable delivery,suitable for applications where speed is prioritized over reliability. The use cases
for UDP are like video streaming, YouTube, Netflix, online gaming, DNS queries. The choice between TCP and UDP depends on the application's requirements such as use TCP when data accuracy and order matter, such as banking websites. and use UDP when speed is critical and minor losses are acceptable, such as live video streaming. Why does the transport layer matters in ethical hacking, it is used for targeting protocols, many attacks exploit the differences between TCP and UDP. For instance, TCP SYN flood overwhelms a server by sending a flood of SYN requests without completing the handshake. How it works A SYN flood is a denial-of-service attack targeting TCP's three-way handshake process The attacker sends a high volume of SYN packets to a target server but does not complete the handshake The server allocates resources for each connection, waiting for the client to respond with an ACK Eventually, the server's resources are exhausted, making it unavailable to legitimate users Signs of SYN flood attack is A sudden increase in half-open TCP connections High CPU or memory usage on the targeted server An attacker uses a tool like Ping3 to generate SYN requests, overwhelming a web serverUDP Flood Floods a target with UDP packets to exhaust its resources.
Recognizing vulnerabilities Understanding how TCP ensures reliability can help identify weaknesses like improper acknowledgment handling. Knowing UDP's lack of reliability aids in spotting potential exploitation points in streaming services or DNS servers. How they work. Reflection and amplification attacks exploit the connectionless nature of UDP and typically involve spoofing the source IP address In the reflection, the attacker sends a UDP request to a server, spoofing the victim's IP as the source The server's response is directed to the victim, overwhelming it While in the amplification, the attacker leverages services like DNS or NTP that send responses larger than the original requestThis significantly increases the traffic volume sent to the victim. The key examples are like the DNS amplification attack, where: The attacker sends small DNS queries with a spoofed source IP. The DNS server responds with much larger responses, amplifying the attack's impact. The NTP
amplification attack, where the hacker exploits the monlist command in NTP servers. to generate massive responses. These attacks can flood a victim's network with traffic, rendering services inaccessible. Both TCP and UDP are essential for network communication, but their design and functionality introduce specific vulnerabilities that attackers can exploit. Understanding these
vulnerabilities and implementing best practices is critical for securing networks. The best practices for securing TCP and UDP are like configuring firewall rules for TCP or UDP ports. The firewalls can filter traffic based on port numbers, blocking unnecessary or malicious connections. The best practices are like allow only required ports. For example, permit
port 80 for HTTP and port 443 for HTTPS, while blocking unused ports. Restrict open UDP ports. Limit UDP traffic to only necessary services, such as DNS, port 53.
Use stateful firewalls. The stateful firewalls track active connections, distinguishing between legitimate and malicious traffic. Next, configure rate limiting and intrusion detection policies. The rate limiting prevents abuse by limiting the number of requests per second from a single IP address. For example, limit SYN packets per IP to mitigate SYN flood attacks. Tools like
IPTBLS or PFSense can enforce rate-limiting rules. And the intrusion detection and prevention systems use systems like Snort or Suricata to monitor and detect malicious traffic patterns. Configure IDS and IPS to detect abnormal traffic spikes indicative of SYN floods or UDP amplification. and block malicious packets, such as those with spoofed IP addresses. The
additional strategies which can be followed are like: Enable SYN cookies the SYN cookies help mitigate SYN flood attacks by not allocating resources until the handshake is complete. Most modern operating systems support this feature. The patch and secure UDP services ensure services like DNS and NTP are updated and configured securely. Disable unnecessary commands, like monlist in NTP Deploy load balancers, the load balancers distribute incoming traffic, preventing a single server from being overwhelmed during an attack Let us take some of the practical example of security defense, for example the DNS amplification attack The problem is that a DNS server is being exploited to flood a victim with amplified responses To solve this problem,Configure the DNS server to respond only to legitimate queries. Use rate limiting to control the number of queries from a single source. Implement a
firewall rule to block suspicious IPs attempting large-scale queries. The next example is a SYN flood attack, where the problem is that a web server is targeted by SYN flood, exhausting its resources. The solution for this is to enable SYN cookies to mitigate resource exhaustion. Use an
IPS like Snort to detect and block suspicious SYN packets. Deploy a load balancer to handle incoming traffic efficiently. How does this matters for ethical hacking?1. Exploiting weaknesses. The ethical
hackers simulate SYN floods or reflection attacks to test the resilience of networks. Understanding these vulnerabilities helps in designing effective penetration tests. Second, securing networks. By implementing best practices like firewalls and IDS, you can protect against these attacks and ensure network availability. And the third is analyzing traffic. Tools like Wireshark and MAP can help identify abnormal patterns indicative of TCP/UDP-based attacks.
And with that, we've reached the end of today's lecture on the TCP/IP model and security best practices. We hope you've gained valuable insights into how this fundamental protocol suite shapes our network communications and how we can work to secure it. Remember, understanding TCP/IP isn't just about memorizing protocols, it's about seeing the bigger picture of how network communications flow and where security measures can be most effectively implemented. The concepts we've covered today will be essential as we move forward in our ethical hacking journey.
Speaking of moving forward, in our next lecture, we'll be diving into IP addressing, where we'll explore both IPv4 and IPv6, subnetting, and the security implications of proper IP address management. This will build directly on what we've learned today, so make sure to review these TCP/IP concepts before our next session. If you've found this lecture helpful, please don't forget to hit that like button and subscribe to our channel. Your support helps us continue providing this educational content and building our ethical hacking community. Feel free to
drop any questions in the comments below, we will be monitoring and responding to help clarify any concepts you'd like to explore further. Until next time, stay curious and hack ethically. See you in our next lecture.
2024-12-27 19:04
