WEBVTT - This file was automatically generated by VIMEO

1
00:00:10.100 --> 00:00:13.200
 Hello everyone. Welcome back to the next section. It is for

2
00:00:13.200 --> 00:00:16.800
 intersection will be talking all about the different attack vectors

3
00:00:16.800 --> 00:00:19.700
 over the network. What are the different tools

4
00:00:19.700 --> 00:00:22.500
 that can be used in order to session?

5
00:00:22.500 --> 00:00:25.700
 Hijack? If input called to get started,

6
00:00:25.300 --> 00:00:28.100
 we talked about the first attack Vector known as

7
00:00:28.100 --> 00:00:31.500
 TCP predicting the sequence. This is an old risk and

8
00:00:31.500 --> 00:00:34.000
 not that something that we see on modern day.

9
00:00:34.900 --> 00:00:37.600
 As we saw in a previous section bad

10
00:00:37.700 --> 00:00:40.600
 we did take a look at the tree behind check

11
00:00:40.100 --> 00:00:43.600
 for a TCP connection and

12
00:00:43.200 --> 00:00:46.600
 in why shock we did see that by

13
00:00:46.600 --> 00:00:49.300
 default. The tool shows us. The

14
00:00:49.300 --> 00:00:52.400
 first sequence number to be a zero, but

15
00:00:52.400 --> 00:00:54.300
 that is only for human readability.

16
00:00:55.900 --> 00:00:59.000
 And when we looked at the actual data itself, it

17
00:00:58.100 --> 00:01:01.800
 was quite sure that there was a pseudo-random number

18
00:01:01.800 --> 00:01:04.100
 that was generated, and which was

19
00:01:04.100 --> 00:01:06.300
 very difficult to protect itself.

20
00:01:07.500 --> 00:01:10.200
 So what candidly happen during this attack is

21
00:01:10.200 --> 00:01:13.500
 such that if an attacker is able to guess

22
00:01:13.700 --> 00:01:16.400
 a particular sequence number that is being generated during

23
00:01:16.400 --> 00:01:20.300
 the handshake. Those packets could be forced. And

24
00:01:19.400 --> 00:01:22.700
 while doing so based on

25
00:01:22.800 --> 00:01:25.500
 the type of attack, the attacker

26
00:01:25.500 --> 00:01:29.400
 can actually inject. The data core

27
00:01:28.500 --> 00:01:32.000
 can actually send out different TCP

28
00:01:31.100 --> 00:01:34.400
 Flags in order to either terminate

29
00:01:34.400 --> 00:01:35.400
 the connection as well.

30
00:01:36.300 --> 00:01:39.400
 And these sort of and abilities were actually seen in

31
00:01:39.400 --> 00:01:42.700
 older OSS such as BSD, Unix

32
00:01:42.100 --> 00:01:45.600
 and Windows NT 3.5 and

33
00:01:45.600 --> 00:01:48.600
 for as well, there's something we

34
00:01:48.600 --> 00:01:51.500
 don't see on modern day to day open

35
00:01:51.500 --> 00:01:54.500
 systems because they have ensured that every operating

36
00:01:54.500 --> 00:01:58.200
 system can actually generate a random number,

37
00:01:57.200 --> 00:01:59.900
 such that an attacker can operate it.

38
00:02:01.200 --> 00:02:05.100
 Just let's understand the scenario. So, in a typical scenario where

39
00:02:04.500 --> 00:02:07.400
 we have a user actually

40
00:02:07.400 --> 00:02:10.500
 trying to create a TCP 3-way handshake. So,

41
00:02:10.500 --> 00:02:13.300
 as we know the first packet, that would be sent is the syn

42
00:02:13.300 --> 00:02:16.100
 flag, followed by that. The server is

43
00:02:16.100 --> 00:02:19.300
 going to respond back with the Synod ack. And in

44
00:02:19.300 --> 00:02:22.100
 order to complete the three way. The client is again, going

45
00:02:22.100 --> 00:02:25.100
 to send back the acknowledgement work in order to

46
00:02:25.100 --> 00:02:26.700
 complete a connection.

47
00:02:27.600 --> 00:02:30.900
 So, if we take the scenario, where an attacker is

48
00:02:30.900 --> 00:02:33.100
 able to send the

49
00:02:33.100 --> 00:02:36.400
 flag such that you can predict the sequence in

50
00:02:36.400 --> 00:02:39.700
 such a way, spoofing, the source, as the victim itself.

51
00:02:39.200 --> 00:02:42.600
 So the server is going to respond back

52
00:02:42.600 --> 00:02:46.100
 to the source. That is the victim of you along

53
00:02:45.100 --> 00:02:48.500
 with the particular acknowledge

54
00:02:48.500 --> 00:02:49.800
 and flag in response.

55
00:02:50.700 --> 00:02:54.700
 And in order to complete the third acknowledgement

56
00:02:53.700 --> 00:02:56.300
 flag, the attacker is

57
00:02:56.300 --> 00:02:59.400
 again going to print the sequence and computer 3-way

58
00:02:59.400 --> 00:03:02.500
 handshake. So this is something good

59
00:03:02.500 --> 00:03:05.600
 to know basis as to how this attack has

60
00:03:05.600 --> 00:03:06.400
 already happened.

61
00:03:07.600 --> 00:03:09.300
 That's it for this video. Thank you.