Ethical Hacking Techniques

SYN Flood is one of the oldest denial-of-service attacks, and it is still effective today. Here's what happens under the hood... A TCP connection is established with a three-way handshake: the client sends a SYN, the server responds with a SYN-ACK, and the client completes it with an ACK. What's interesting is that during this process, the server allocates memory for each half-open connection in a backlog queue. In a SYN Flood, an attacker sends thousands of SYN packets but never completes the handshake. The server keeps waiting for ACKs that never arrive, and the backlog queue fills up. Once it is full, legitimate users can not connect anymore. Thus, a DoS attack. What makes this attack effective is the 'asymmetry' - the attacker sends tiny packets with minimal effort, but the server has to allocate resources for each one. A single low-powered machine can overwhelm a much more powerful server. Fun fact: SYN floods have taken down GitHub, Cloudflare, and several databases in the past. To defend against SYN flooding, we can: 1. Cap the number of SYN packets from a single IP 2. Drop packets from known malicious sources 3. Or, the most effective, use SYN Cookies With SYN cookies, the server does not store anything. Instead, it encodes all the necessary connection information (client IP, port, and a timestamp) into the initial sequence number of the SYN-ACK packet it sends back. This sequence number is cryptographically generated, so it cannot be forged. SYN cookies make the handshake effectively stateless on the server side until it's fully verified, so the server does not reserve any resources until it knows the client is real. By the way, most modern operating systems have SYN cookie support built in. On Linux, we can enable it with `net.ipv4.tcp_syncookies = 1`. If you are interested, the Wikipedia pages are pretty well written for understanding this, and as always, you can use your favorite LLM to dig deeper.

The risk of insecure WiFi has just increased, with the revelation of the Nearest Neighbor attack, used in 2022 by the Russian GRU. Attacking WiFi is usually assumed to require close access - “war driving” to discover networks, and then connecting from an antenna close to the target. According to cyber security firm Volexity, in early 2022, attackers from Russian military intelligence agency GRU (aka APT28, aka Fancy Bear) were able to compromise a Washington DC-based office across the street from their target, then use WiFi from the compromised WiFi network to attack the target network. This method of attack reduces operational risk, as it can be carried out from abroad rather than risking a “Mission Impossible” team on the ground. We can probably assume this style of attack is already in use elsewhere. As with most cybersecurity, the basics apply here: 🔵 Upgrade to a strong WiFi security protocol such as WPA3-Enterprise 🔵 Apply MAC address filtering to only allow known NICs to connect to your WiFi 🔵 Use separate WiFi networks for IOT devices (anyone remember the casino that got hacked using the fish tank thermometer?) 🔵 Segment your networks to prevent lateral movement (see NIST SP 800-207 for advice on how to do this well, aka “Zero Trust”) 🔵 Consider using Ethernet and avoid WiFi altogether! It’s faster and more reliable…

In 2018, Dutch police red-handedly caught foreign spies who hacked into UN chemical weapons organization. Their attack method: Parking vehicles outside of target buildings, and infiltrating target's Wi-Fi networks to hack victims!   They were caught in person due to their physical presence near the target. As per a recent report (from Volexity), attackers now developed a new technique to overcome this risk: By "remotely" breaching the target's Wi-Fi by hijacking a laptop in a nearby building across the street! How is that even possible? Read on to learn more…   𝗔𝘁𝘁𝗮𝗰𝗸 𝗙𝗹𝗼𝘄: 1) The attacker uses password-spraying attack on target company's public-facing service > Gains credentials > But MFA blocks access.   2) The same credentials can access target enterprise's Wi-Fi (which does not have MFA) > But the challenge: the attacker is thousands of miles away from the target and cannot authenticate to Wi-Fi. 3) Here comes the genius: To overcome this, attacker starts looking for organizations located in target's nearby buildings (to use them as a bridge to connect to target's Wi-Fi)   4) Over months, attacker compromises nearby organizations, using their networks to get closer!   5) In the compromised orgs, attacker locates dual-home devices e.g., laptops with both wired and wireless connections near the target’s Wi-Fi range.   6) Using a dual-home device, they connect to target's Wi-Fi access points (remember they already have valid creds from step 1).   7) Once on target Wi-Fi, attacker uses RDP from an unprivileged account > Moves laterally, find valuable data > Exfiltrates it using built-in Windows tools to avoid detection.   𝗔 𝗙𝗲𝘄 𝗧𝗵𝗼𝘂𝗴𝗵𝘁𝘀: 1) Modern attackers are problem solvers first, hackers second. They can turn almost an impossible sounding event into possible.   2) When MFA blocks the front door, attackers will simply find a door without MFA. In this case, "corporate Wi-Fi" was that unlocked door. Threat model to identify similar unlocked doors in your company. 3) Corporate Wi-Fi networks are often overlooked in security assessments. Use certificates to authenticate devices or users (instead of passwords that can leak). This way, only devices with valid certificates can connect.   4) Segment and isolate networks. Create separate VLANs for different purposes - ex: Corporate vs Guest vs IoT.   5) Monitor Wi-Fi signal strength at your company's physical perimeter to reduce exposure of access points outside your premises. 6) Adopt WPA3-Enterprise encryption for enhanced security. If you enjoyed this or learned something, follow me at Rohit Tamma or more in future! #infosec #enterprisesecurity #wifisecurity #cybersecurity #applicationsecurity

WiFi Pentesting with Aircrack-ng: Test Wireless Security in the Lab 📡🛠️ Aircrack-ng is a powerful, open-source suite of tools used to audit wireless networks — ideal for learning how to assess the strength of Wi-Fi encryption in authorized lab environments. 🧠 Key Capabilities of Aircrack-ng: • Capture and analyze wireless packets • Perform handshake capture for WPA/WPA2 networks • Crack WEP and WPA keys using dictionary attacks (educational use only) • Test packet injection and monitor wireless signal quality • Identify hidden networks and weak configurations Why it's useful: Understanding how wireless networks can be attacked helps defenders build stronger encryption policies, detect rogue devices, and apply safer configurations. ⚠️ Disclaimer: This content is shared strictly for educational and ethical use. Only test wireless networks you own or have explicit written permission to assess. #AircrackNG #WiFiSecurity #WirelessPentesting #CyberSecurity #InfoSec #EthicalHacking #EducationOnly #NetworkAuditing #WPA2 #WirelessHackingLab

A candidate interviewing for a DevSecOps role at Google was asked to design protection for Google Drive against DDoS. Another candidate interviewing for a Security Engineer role at Amazon was asked how they would protect a single login endpoint from getting flooded. I have faced similar variants too. DDoS questions look simple until you add one extra requirement: - Add global users -> now you are fighting geo-based attackers and latency. - Add auto scaling -> now you are balancing protection versus cost explosion. - Add API consumers -> now you need identity-aware limits, not just IP-based rules. Here is my personal checklist of 15 things you must get right when defending against DDoS and DoS attacks: 1. Separate volumetric and application layer attacks → Treat L3 or L4 floods (SYN, UDP, ICMP) differently from L7 floods (HTTP, login spam). Controls, tools and signals are different. 2. Put a managed edge in front of your origin → Use CDN, WAF or cloud DDoS protection so most garbage dies at the edge and never hits your VPC or cluster. 3. Rate limit at multiple layers → Per IP, per user, per API key, per client type. One global limit is never enough, attackers pivot around it. 4. Make limits identity aware, not just IP aware → Use tokens, API keys or auth context to rate limit real users differently from anonymous traffic. NATs and mobile networks break simple IP limits. 5. Protect the most expensive paths first → Login, search, complex queries, PDF generation. Add stricter limits and extra friction where each request is costly in CPU or DB time. 6. Use cheap filters before expensive checks → Block bad IP ranges, invalid headers and malformed payloads before you hit your app logic or database. Fail fast and fail cheap. 7. Build progressive challenges, not instant CAPTCHAs everywhere → Start with soft blocks like small delays and basic puzzles. Escalate to CAPTCHAs or hard blocks only when traffic looks suspicious. 8. Enforce tight connection and timeout policies → Short timeouts, limited keep alive and sane max headers or body sizes reduce the blast radius of slow loris and similar resource hogs. 9. Design for graceful degradation → When load spikes, drop non critical features first. Serve cached responses, hide heavy widgets, maybe return simplified pages instead of failing everything. 10. Use queueing to protect fragile backends → Put critical operations behind queues, with maximum depth and back pressure. When queues are full, reject early with clear errors. 11. Tune autoscaling with security in mind → Autoscaling without protection becomes a credit card DDoS. Put limits on max scale, combine with WAF signals, never rely on “infinite” scale. Please check the first comment; I’ve included the rest of the post there. -- ♻️ Share this for future reference 📢 Follow saed ‎for more & subscribe to the newsletter: https://lnkd.in/eD7hgbnk I am now on 📸 Instagram: instagram.com/saedctl say hello, DMs are open

Hackers Breach U.S. Firm Over Wi-Fi—From Thousands of Miles Away 🚨 In a groundbreaking attack, Russian state hackers APT28 (Fancy Bear) bypassed physical proximity to breach a U.S. firm’s Wi-Fi network—directly from Russia. Using a creative “Nearest Neighbor Attack,” they exposed critical vulnerabilities in corporate Wi-Fi security. → What Happened? APT28 compromised a nearby organization via password-spraying attacks, then exploited dual-home devices to leap onto the target’s Wi-Fi network. By bypassing MFA and exploiting a zero-day vulnerability in Windows Print Spooler (CVE-2022-38028), they infiltrated systems, exfiltrated sensitive data, and escalated privileges—all remotely. → Why This Attack is Groundbreaking: ↳ Hackers no longer need to be physically close, like in a parking lot. ↳ This “Nearest Neighbor Attack” uses nearby networks as a gateway to victims. ↳ Detected by Volexity, it highlights the hidden dangers of unsecured corporate Wi-Fi. → Lessons for Securing Your Corporate Wi-Fi: ➜ Implement Network Segmentation ↳ Isolate Wi-Fi from critical systems to limit hacker movement. ➜ Strengthen Authentication ↳ Use enterprise-grade encryption and authentication protocols. ➜  Monitor Device Behavior ↳ Track connections and flag unusual patterns. ➜ Update Systems Regularly ↳ Patch vulnerabilities like Print Spooler to close potential entry points. ➜ Secure Dual-Home Devices ↳ Protect devices that bridge wired and wireless networks. APT28’s attack proves hackers no longer need physical proximity to infiltrate corporate systems. Act now to fortify your Wi-Fi security before it’s too late. PS: How secure is your Wi-Fi network? Share your steps to protect it and help others stay vigilant. ♻️ Repost to spread awareness about this critical threat. 🔔 Follow Brent Gallo - CISSP for expert insights on staying ahead of cyberattacks. #CyberSecurity #WiFiSecurity #APT28 #DataBreach #NetworkSecurity #ZeroDay #ITSecurity #CyberThreats

 THREAT INTELLIGENCE: COMMON DDoS AMPLIFICATION ATTACK VECTORS ℹ️ DDoS amplification attacks exploit the vulnerabilities in specific network protocols to amplify the volume of traffic directed at a target. Understanding the most common amplification vectors is crucial for developing effective mitigation strategies: 📍 DNS AMPLIFICATION Attackers send small DNS query requests with a spoofed IP address (the target’s) to an open DNS resolver. The resolver then sends a much larger response to the target, amplifying the traffic significantly. 📍 NTP AMPLIFICATION NTP servers can be misused for amplification attacks through the "monlist" command, which returns a list of the last 600 clients that accessed the NTP server. When attackers send a request to an NTP server with the victim's IP address, the server replies with a significant response, amplifying the traffic. 📍 MEMCACHED AMPLIFICATION Memcached is a database caching system that can be exploited to generate enormous traffic. Attackers send small requests to exposed Memcached servers, which respond with much larger packets to the target. 📍 SSDP AMPLIFICATION Attackers can exploit SSDP by sending requests to vulnerable devices that respond with a much larger reply to the victim’s IP address. 📍 CHARGEN AMPLIFICATION Chargen (Character Generator Protocol) is an older, less commonly used protocol that sends a stream of characters to any device that connects to it. Despite its limited use, it can still be exploited for DDoS amplification. By sending small requests to a Chargen server, attackers can generate significant responses directed at the target. 📍  CLDAP AMPLIFICATION CLDAP servers respond to queries with much larger responses, allowing attackers to use them to amplify traffic towards a target by a factor of up to 50:1. 📍 SNMP AMPLIFICATION Attackers can exploit SNMP by sending small requests to public SNMP devices, which then respond with larger packets to the spoofed IP address. 🛡️ MITIGATION STRATEGIES To mitigate these types of DDoS attacks, it is essential to close or secure unnecessary services and ports, implement rate limiting, and employ DDoS protection solutions that can detect and filter malicious traffic. Additionally, network administrators should ensure that network devices are configured securely and updated with the latest security patches. Table: Radware H1 2024 GLOBAL THREAT ANALYSIS REPORT #ddos #threathunting #threatdetection #threatanalysis #threatintelligenceteam #threatintelligence #cyberthreatintelligence #cyberintelligence #cybersecurity #cyberprotection #cyberdefense

𝑾𝒉𝒂𝒕 𝑰𝒔 𝑾𝒂𝒗𝒆𝒍𝒆𝒏𝒈𝒕𝒉 𝒂𝒏𝒅 𝑾𝒉𝒚 𝑰𝒕 𝑴𝒂𝒕𝒕𝒆𝒓𝒔 𝒊𝒏 𝑾𝒊𝒓𝒆𝒍𝒆𝒔𝒔? Engineers talk about 2.4 GHz, 5 GHz, 28 GHz and 77 GHz but hardware doesn’t react to “GHz”, it reacts to wavelength. Antenna size, range, penetration, multipath, beamforming even noise behavior, almost everything in wireless scales with λ. You don’t design using frequency, you design using the physical size of the wave. 1. Why Wavelength Dominates Everything? Frequency alone doesn’t tell you how a wave behaves, wavelength does. Buildings, vehicles, walls and the human body interact with EM waves based on how their size compares to λ. If an object is much smaller than λ, the wave bends around it (good penetration). If it’s similar in size, the wave reflects and scatters (bad coverage). Wavelength defines how electromagnetic energy “sees” the world not the number in GHz. 2. What Wavelength Really Controls? Wavelength determines antenna size, resonance, array spacing, waveguide dimensions, matching networks and propagation loss. Short λ means tiny antennas but also higher FSPL and more severe multipath because the wave interacts with microscopic surface roughness. Long λ improves coverage and penetration but forces physically large radiators. Every RF layout, from PCB antennas to satellite arrays is fundamentally a geometry problem governed by λ. 3. Why Wavelength Determines Wireless Performance (Not Frequency)? Signal strength, link reliability, diffraction, beam sharpness, isolation and fading patterns all follow wavelength behavior. Your range, dead zones and penetration capabilities are basically functions of λ. Two systems at different frequencies might “sound similar” in specs but if their wavelengths differ, their real-world performance is completely different. This is why engineers think in fractions of λ, it is the true scale that dictates what is possible. 4. Critical Formulas: a) Wavelength definition: → λ = c / f b) Half-wave dipole length: → L ≈ λ / 2 c) Free-space path loss: → FSPL ∝ (4πd / λ)² d) Antenna aperture: → Aₑ = λ² / (4πG) 5. Real-World Examples: - 2.4 GHz Wi-Fi penetrates walls better than 5 GHz because its λ is longer (12.5 cm vs 6 cm). - 28 GHz 5G uses massive MIMO, tiny λ (~1 cm) allows large arrays in small spaces. - FM radio (λ ≈ 3 m) works in tunnels and deep indoors, unlike mmWave links. - Automotive radars at 77 GHz use short wavelengths for high spatial resolution. Wavelength is the invisible ruler behind every wireless system. Frequency is just a number, wavelength decides the physics. #WirelessEngineering #Electromagnetics #AntennaDesign #Wavelength #RFSystems #PhDResearch

New WiFi attack: WPA3->WPA2 Downgrade Attack WPA3-SAE improves security by resisting offline dictionary attacks, yet researchers found that WPA2/WPA3 transition mode presents exploitable weaknesses. By forcing downgrade attacks, adversaries can capture partial WPA2 handshakes that retain enough data to validate the passphrase. This bridging of WPA2 and WPA3 protocols is key to the vulnerability. Attackers combine denial-of-service (DoS) methods, such as overloading the access point with malformed frames or race conditions, to disconnect legitimate users. Then they spawn a rogue AP with the same SSID and a captive portal to trick victims into entering the password, which is checked against the captured handshake. Disabling or misconfiguring Protected Management Frames (PMF) is a prerequisite for this approach, and some hardware remains ill-equipped to handle the surge of commit frames or block bogus connections. Once the password is obtained, intruders gain immediate access to the network. The paper demonstrates that WPA3, despite its advancements, can be compromised when transition modes are used improperly and social engineering tactics target unsuspecting users. It underscores the critical need for correct PMF implementation, using WiFi hardware that can handle resource-intensive tasks, and the need for user awareness of potential phishing through rogue portals. https://lnkd.in/geydJQXh

My first DDoS attack with a client was a real eye-opener. SFCC's WAF helped us successfully defend against it. Here's what I learned the hard way (so you don't have to): 𝗦𝘁𝗲𝗽 𝟭: 𝗙𝗹𝗶𝗽 𝘁𝗵𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 (𝗪𝗔𝗙) The first thing I saw was the on/off toggle. My brain screamed: 𝗧𝗨𝗥𝗡 𝗜𝗧 𝗢𝗡! This activates WAF for your zone, and if your site is getting pummeled, enabling it is non-negotiable. If it's already on, good job - you're one step ahead of where I was. 𝗦𝘁𝗲𝗽 𝟮: 𝗖𝗵𝗼𝗼𝘀𝗲 𝗬𝗼𝘂𝗿 𝗣𝗹𝗮𝗻 (𝗔𝗰𝘁𝗶𝗼𝗻) Next came the Action dropdown. Three options, all of which felt like they could make or break everything: - 𝗦𝗶𝗺𝘂𝗹𝗮𝘁𝗲: Logs suspicious activity without actually doing anything. Great for learning how WAF works, but not helpful when your client's site is under siege. - 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲: Throws suspicious visitors a CAPTCHA. I called this "the prove-you're-not-a-bot move." It slows attackers but lets humans through. - 𝗕𝗹𝗼𝗰𝗸: My favorite during the attack. If it's suspicious, it's gone. No CAPTCHAs, no second chances - just a hard "NOPE." 𝗦𝘁𝗲𝗽 𝟯: 𝗦𝗲𝘁 𝘁𝗵𝗲 𝗠𝗼𝗼𝗱 (𝗦𝗲𝗻𝘀𝗶𝘁𝗶𝘃𝗶𝘁𝘆 𝗟𝗲𝘃𝗲𝗹) This was where the real stress hit. - 𝗟𝗼𝘄: Felt like using a screen door during a hurricane. - 𝗠𝗲𝗱𝗶𝘂𝗺: Balanced enough to protect the site without locking out too many legit users. - 𝗛𝗶𝗴𝗵: Went full Fort Knox. Effective, but I had to keep an eye on the logs to ensure it wasn't blocking real customers. I went with High during the attack and adjusted later. You'd be amazed at how quickly you get comfortable with tweaking settings when the stakes are this high. 𝗦𝘁𝗲𝗽 𝟰: 𝗧𝗿𝘂𝘀𝘁 𝘁𝗵𝗲 𝗟𝗼𝗴𝘀 At first, I ignored the logs because I thought, "There's no time for that!" Big mistake. The logs were a goldmine of info: - What kind of threats WAF detected. - Why specific requests were blocked or challenged. - Patterns I could use to refine the settings. 𝗣𝗿𝗼 𝘁𝗶𝗽: Review the logs constantly during an attack. They'll tell you exactly what's going on and help you avoid over-blocking legitimate users. 𝗛𝗲𝗿𝗲'𝐬 w𝗵𝗮𝘁 𝗜 l𝗲𝗮𝗿𝗻𝗲𝗱 𝗶𝗻 𝘁𝗵𝗲 f𝗶𝗿𝗲 1. 𝗦𝘁𝗮𝗿𝘁 𝘄𝗶𝘁𝗵 𝗕𝗹𝗼𝗰𝗸: In a crisis, stop the bleeding first. You can adjust later. 2. 𝗞𝗲𝗲𝗽 𝗮𝗻 𝗘𝘆𝗲 𝗼𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗟𝗲𝘃𝗲𝗹𝘀: Too low, and the attack continues. Too high, and you lose real customers. Find the balance. 3. 𝗟𝗼𝗴𝘀 𝗔𝗿𝗲 𝗬𝗼𝘂𝗿 𝗕𝗲𝘀𝘁 𝗙𝗿𝗶𝗲𝗻𝗱: They're not just a record - they're a guide. 4. 𝗪𝗔𝗙 𝗪𝗼𝗿𝗸𝘀 𝗤𝘂𝗶𝗰𝗸𝗹𝘆: The changes you make are instant, so don't panic if something goes wrong—fix it and move on. Long story short, if you haven't familiarized yourself with WAF, do it now. Don't wait until you're in the middle of an attack. Have you ever had to learn a tool under pressure?