Networks for hackers

SECTION 7

What Are Networks?

A network is a group of interconnected devices (like computers, phones and servers) that communicate and share resources. Networks allow data to travel between devices, enabling things like internet access, file sharing and online communication.

OSI Model

The OSI model is a framework used to understand how networking protocols interact and how data travels across a network. Even though this is probably the most boring part of hacking, it is important to understand the basics of how networks work.

It is important to know how OSI-layers work because each of the layers has their own security risks and vulnerabilities:

• Physical Layer: Hardware tampering or wiretapping.
• Data Link Layer: MAC address spoofing or ARP poisoning.
• Network Layer: IP address spoofing or routing attacks.
• Transport Layer: Session hijacking or TCP/IP attacks.
• Application Layer: Malware, phishing or SQL injections.

Notable network devices and their functions

• Router: Directs data between networks and connects a LAN to the internet.
• Firewall: Monitors and controls incoming/outgoing network traffic for security.
• Server: Provides services or resources (like websites or files) to other devices.
• Client: A device that requests services from a server (e.g., your laptop accessing a website).

Notable protocols and common exploits/vulnerabilities

• HTTP/HTTPS:
  • Used for web traffic.
  • Exploited via attacks like XSS, SQL injection, and man-in-the-middle (MITM).
• DNS (Domain Name System):
  • Translates domain names to IP addresses.
  • Vulnerable to DNS spoofing, cache poisoning, and tunneling.
• FTP (File Transfer Protocol):
  • Transfers files between systems.
  • Often targeted due to weak authentication or unencrypted data.
• SMB (Server Message Block):
  • Used for file and printer sharing in Windows networks.
  • Exploited in attacks like WannaCry ransomware (via EternalBlue vulnerability).
• SSH (Secure Shell):
  • Secure remote login.
  • Targeted for brute-force attacks or credential theft.
• ICMP (Internet Control Message Protocol):
  • Used for diagnostics (e.g., ping).
  • Can be abused in DDoS or network reconnaissance.
• ARP (Address Resolution Protocol):
  • Maps IP addresses to MAC addresses.
  • Vulnerable to ARP spoofing/poisoning.

⚠️ Note: Technical vulnerabilities are really common, because of misconfigurations, outdated software and lack of security awareness. The code itself is often not the problem, but rather the way it is used or configured.

Exercise

This exercise will help you understand how these things apply in practice.

• Scan your home network using a tool like Nmap and Arp-scan
• Identify open ports and services running on your devices
• Check for any unauthorized devices connected to your network
• Document your findings and take action if needed

This exercise will help you understand how networks work and how to identify potential vulnerabilities in your own network. It is important to practice these skills in a safe and legal environment, such as your own home network.