Networking Equipment Flashcards
(31 cards)
7 commonly used protocols for remote management of devices?
- Telnet
- Web based protocols (HTTP, HTTPS)
- SSH
- SNMP
- TFTP
- Cisco Reverse Telnet
- NTP
Management Protocols - Telnet?
- Not encrypted, all plain text
Management Protocols - Web Based Protocols
HTTP (HyperText Transfer Protocol)
- Not encrypted, all plain text
HTTPS
- Secure, TLS 1.3 is latest version - 1.2 vulnerable
Management Protocols - Secure Shell
- Secure, depends on encryption
- can log in with uname and password or without if have the private key
Management Protocols - SNMP (Simple Network Management Protocol)
- Used by Network Management Systems (NMS) to monitor network infrastructure
- SNMPv1 is unencrypted
SNMPv3 (latest) is encrypted
SNMP could leak credentials and other data.
If there is write access - remote code execution is possible
Management Protocols - TFTP (Trivial File Transfer Protocol)
- Simple to implement
- No authentication or access control mechanisms
Management Protocols - Cisco Reverse Telnet
- Allows the Telnet server to write to a computer terminal or device
Telnet - Network to network
Reverse telnet - network to serial (hardware communication)
Management Protocols - NTP (Network Time Protocol)
- Used to synchronise clock between computer systems in a network (UDP port 123)
- Could leak system info, host names of network, etc.
nmap -sU -sV –script “ntp* and (discovery or vuln) and not (dos or brute)” -p 123 <target_ip></target_ip>
What would you use for local network traffic analysis?
Wireshark
Raw data can be seen at each different layer:
Frame -> Ethernet -> IPv4 -> Http
This shows hexdumps of data.
Files can be extracted from PCAP files.
How to extract HTTP files?
- Open the .pcap file
- File -> Export Objects -> HTTP…
- Choose what you want to save
How to extract FTP files?
- Filter for FTP-DATA packets
- Right-click -> Follow -> TCP Stream
- Select RAW as the output type
- Save the file
What is ARP?
Description and Security issues?
Address resolution Protocol (ARP)
Discovers MAC addresses in the network.
No authentication
ARP Spoofing - pretends to be another computer for man in the middle attacks.
What is DHCP?
Description and Security issues?
Dynamic Host Configuration Protocol (DHCP)
Automatically assigns IP addresses to new devices in the network.
Commonly found in routers.
No Authentication required, can be used for man-in-the-middle attacks or unauthorised access to resources or DoS
What is CDP?
Description and Security issues?
Cisco Discovery Protocol (CDP)
Used to share info about other directly connected Cisco equipment, such as OS version and IP address.
Information leakage
What is HSRP?
Description and Security issues?
Hot Standby Router Protocol (HSRP)
Provides redundancy for routers through virtual MAC addresses etc.
DoS, take over active router.
What is VRRP?
Description and Security issues?
Virtual Router Redundancy Protocol (RVVP)
Provides redundancy for routers through virtual MAC addresses, but incomplete.
DoS, take over active router
What is VTP?
Description and Security issues?
VLAN Trunking Protocol (VTP)
Cisco Protocol
Sends VLAN info to whole of LAN.
VTP-bomb
Network uses config with highest config revision number.
If a new switch is added to a network with correct VTP domain name and password, but the switch has a higher revision number, the whole network will use the VTP info from the new switch, which will overwrite the current config.
What is STP?
Description and Security issues?
Spanning Tree Protocol (STP)
Helps network traffic flow with less congestion, saving resources
No security issues
What is TACACS+ ?
Description and security issues?
Terminal Access Controller Access Control System Plus
Provides authentication, authorisation and accounting (AAA) services to the network.
No security issues.
Enumeration and fingerprinting of
IPSec 500/UDP
nmap -sU -p 500 <target_ip>
ike-scan -M <target_ip></target_ip></target_ip>
Enumeration and fingerprinting of
VoIP (Voice over IP)
5060 UDP/TCP unencrypted
5061 UDP/TCP encrypted
Similar to HTTP, request-response model, with use-agent and URIs
7 Common request types within SIP
- INVITE - invites an account to join the call
- ACK - confirmation regarding the invite of joining the call
- CANCEL - cancelling a queued call
- REGISTER - registering the user against the SIP server
- OPTIONS - shows the options the caller has
- BYE - ends the call between both sides
- REFER - shows that the receiver needs to communicate through a 3rd party by the info attached to the request
6 SIP requests/responses
1xx - informational
2xx - success
3xx - redirection
4xx - failed requests
5xx - web server cannot complete request
6xx - global errors
SIP interaction structure (6 steps)
- Sender initiates an INVITE request
- Receiver sends back a 100 (trying) response
- Sender starts ringing by sending a 180 (ringing) response
- Receiver picks up the phone and a 200 success response is sent (OK)
- ACK is sent by the initiator
- Call started using RTP
- BYE request sent to end the call
