Skip to main content

TCP Session Hijacking

Although TCP appears to be safe protocol because of all the negotiation involved in session establishment and all the protocol and the precision involved in data exchanged, don't get complacent.its not much secure than it should be. Network Sniffers can be setup  on the unsuspected machine to sniff the data on the network and they can snoop clear text data such userIds and passwords that are not encrypted in any way. I have one of my friend who did all this ,, he sniffed a dozen passwords and played with their network data. He was very much expert in doing sniffing and using them, othes friend don't even know their passwords are just floating in raw txt on the network.
Session hijacking software, such as Hunt, uses another approach to exploit an existing TCP session. These attempt to intercept an established TCP session and hijack one end of the connection from the session to an evil host.

 The problem is that conventional TCP exchanges do not require any authentication or confirmation that they are the actual hosts involved in a previously established connection. After a session has been established between two hosts, those hosts use the following to reconfirm the corresponding host:


  • IP number:The established IP numbers of the hosts must not change.
  • Port numbers : Most protocols communicate between established ports only; ports do not change.
  • Sequence numbers :  Sequence numbers must change predictably in respect to the ISN and the aggregate number of bytes sent from one host to another.
  • Acknowledgement numbers : Acknowledgement numbers must change in respect to delivered sequence numbers and aggregate bytes acknowledged from one host to another.

If a hostile user can observe data exchanges and successfully intercept an ongoing connection with all the authentication parameters properly set, he can hijack a session. Imagine the damage that can be done if this hijacked session is one that has root authority. Many complications and considerations are involved in session hijacking. It is not a trivial endeavor, but it is made simpler using the Hunt software.
Labels:

Comments

Post a Comment

Popular posts from this blog

Database Sharding

Collating some of the resources which talks about Database Sharding. https://en.wikipedia.org/wiki/Shard_(database_architecture) [Feb 2019]  http://highscalability.com/blog/2019/2/19/intro-to-redis-cluster-sharding-advantages-limitations-deplo.html Redis Cluster is the Native Sharding implementation available within Redis that allows your to automatically distribute your data across multiple nodes without having to rely on external tools and utilities. Its covers Sharding with Redis Cluster  where Redis Clusters is divided in 16384 slots and these slots are assigned to multiple Redis Nodes. The  Redis Cluster Specification  is the definitive guide to understanding the internals of the technology, while the  Redis Cluster Tutorial  provides deployment and administration guidelines. [ Jan 2019  ]  https://scalegrid.io/blog/scalegrid-hosting-adds-support-for-highly-available-redis-clusters-with-automated-sharding/ ScaleGrid : Fully Manage...
Post a Comment
Read more

Penetration Testing Basics

Penetration testing, often called “pentesting”,“pen testing”, or “security testing”, is the practice of attacking your own or your clients’ IT systems in the same way a hacker would to identify security holes. Of course, you do this without actually harming the network. The person carrying out a penetration test is called a penetration tester or pentester. The difference between Penetration Testing and Hacking is that you have the system owner's permission to do testing and to identfiy security holes. If you want to do penetration testing u should better ask for his/her permission. Basic Security Concepts Vulnerability: It is a security hole in a piece of software, hardware of Operating system that provides a way to attack the system.A vulnerabilty is as simple as weak passwords and as complex as buffer overflows as well as SQL injection. Security Research: Vulnerabilities are typically searched by security researchers who finds the flaws in the system. Security Research can ...
1 comment
Read more