Certified Ethical Hacker (CEH) Network Attacks, Sniffing, and Perimeter Evasion Syllabus

What is a SYN flood attack and which weakness does it exploit?

A DoS attack that sends many TCP SYN packets (often with spoofed source IPs) without completing the three-way handshake, exhausting the server's half-open connection (backlog) queue so it cannot accept legitimate connections.

What is a SYN flood countermeasure built into TCP stacks?

SYN cookies — the server encodes connection state in the initial sequence number instead of allocating backlog memory, so it does not exhaust the half-open queue.

What is a ping of death attack?

A DoS attack that sends a malformed/oversized ICMP echo packet exceeding 65,535 bytes (via fragmentation); on reassembly it can overflow buffers and crash or reboot vulnerable systems.

What is a Smurf attack?

An amplification DoS in which the attacker sends ICMP echo requests with the victim's spoofed source IP to a network broadcast address, causing all hosts to flood the victim with echo replies.

What is a Fraggle attack and how does it differ from Smurf?

A Fraggle attack is like Smurf but uses spoofed UDP echo (port 7) packets sent to a broadcast address instead of ICMP, amplifying replies toward the victim.

What is a reflection/amplification DDoS attack, and give an example with its amplification advantage.

The attacker sends small spoofed requests (victim's IP as source) to third-party servers that reply with much larger responses to the victim. Examples: DNS amplification and NTP (monlist) amplification, which can yield amplification factors of dozens to hundreds of times the request size.

What is a permanent DoS (PDoS / phlashing) attack?

An attack that damages hardware or firmware (e.g., corrupting/bricking device firmware) so the device must be repaired or replaced, causing prolonged outage rather than a temporary flood.

What is a slowloris (low-and-slow) attack?

An application-layer DoS that opens many HTTP connections and keeps them alive by sending partial headers very slowly, exhausting the web server's connection pool with minimal bandwidth.

What is a multi-vector DDoS attack?

A DDoS that combines multiple attack techniques (e.g., volumetric flooding plus application-layer and protocol attacks) simultaneously, switching vectors to evade mitigation.

What is a botnet and what is the role of a bot herder?

A botnet is a network of compromised computers (bots/zombies) controlled remotely via a command-and-control (C2) channel. The bot herder (botmaster) controls them to launch DDoS, send spam, or steal data.

Name common command-and-control (C2) architectures used by botnets.

Centralized (IRC- or HTTP-based C2 server), peer-to-peer (P2P, no single C2), and randomized/domain-generation-algorithm (DGA) based models for resilience.

What are the three broad categories of DDoS attacks by target?

1) Volumetric attacks (exhaust bandwidth, e.g., UDP/ICMP floods, amplification). 2) Protocol/state-exhaustion attacks (exhaust device tables, e.g., SYN flood). 3) Application-layer attacks (Layer 7, e.g., HTTP GET/POST floods, slowloris).

List three techniques used to detect DoS/DDoS attacks.

Activity profiling (monitoring average packet rate of network flows), sequential change-point detection (isolating traffic spikes from a baseline), and wavelet-based signal analysis of traffic spectral components.

Name three countermeasures/mitigation techniques against DDoS attacks.

Ingress/egress filtering and anti-spoofing (BCP38), rate limiting and traffic scrubbing/black-hole or sinkhole routing, and using upstream/cloud DDoS protection services with load balancing and redundancy.

What is session hijacking?

An attack in which the attacker takes over an established, authenticated session between two hosts by stealing or predicting the session identifier, gaining the victim's authenticated access without needing credentials.

What are the typical phases of a session hijacking attack?

1) Sniff/place yourself in the traffic path (MITM). 2) Monitor the session. 3) Desynchronize the connection. 4) Predict/steal the session token. 5) Inject packets / take over the session.

What is the difference between active and passive session hijacking?

In active hijacking the attacker takes over the session, often forcing the legitimate user offline, and interacts directly. In passive hijacking the attacker only monitors and records the session traffic without altering it.

What is application-level session hijacking?

Hijacking that targets the session token/ID at the application layer (e.g., a web session cookie) to gain or impersonate a valid session, rather than manipulating TCP sequence numbers.

List four techniques used in application-level session hijacking.

Session sniffing (stealing the token from traffic), session fixation (forcing a known session ID on the victim), cross-site scripting (XSS) to steal cookies, and session ID prediction/brute forcing of weak tokens.

What is session fixation?

An attack where the attacker sets or supplies a known session ID to the victim before they authenticate; when the victim logs in with that fixed ID, the attacker reuses it to access the authenticated session.

What is network-level session hijacking and what does it manipulate?

Hijacking of the TCP/IP session by manipulating transport/network protocols — it relies on predicting or capturing TCP sequence and acknowledgment numbers to inject packets and take over the connection.

Why are TCP sequence numbers central to network-level session hijacking?

TCP uses sequence/acknowledgment numbers to order and validate packets. To inject data into an established session, the attacker must use the correct next sequence number; predicting it allows spoofed packets to be accepted as legitimate.

What is TCP/IP session hijacking via desynchronization?

The attacker forces both endpoints into a desynchronized state (their sequence numbers no longer match) — often by injecting data or a reset — then supplies correctly sequenced packets so only the attacker can continue the session.

List three countermeasures against session hijacking.

Use encryption (TLS/HTTPS, IPsec, SSH) end-to-end; use strong, random, regenerated session IDs (regenerate ID after login, set HttpOnly/Secure cookie flags); and use timeouts plus re-authentication and unpredictable initial sequence numbers.

What is the difference between an IDS and an IPS?

An IDS (Intrusion Detection System) passively monitors and alerts on suspicious activity out-of-band. An IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic in real time.

What is the difference between signature-based and anomaly-based detection?

Signature-based (misuse) detection matches traffic against a database of known attack patterns — low false positives but misses zero-days. Anomaly-based detection flags deviations from a learned baseline of normal behavior — can catch new attacks but produces more false positives.

What is the difference between a HIDS and a NIDS?

A HIDS (host-based IDS) monitors a single host's logs, files, and activity. A NIDS (network-based IDS) monitors traffic across a network segment from a sensor/tap.

What are the four main firewall types/generations by inspection method?

Packet-filtering (Layer 3/4, by IP/port), stateful inspection (tracks connection state), circuit-level gateway (Layer 5, monitors TCP handshakes/sessions), and application-level gateway/proxy (Layer 7, inspects content).

What is a honeypot, and what is the difference between low- and high-interaction honeypots?

A honeypot is a decoy system designed to attract and study attackers. Low-interaction honeypots emulate limited services (low risk, less data); high-interaction honeypots run real services/OS (more realistic data but higher risk if compromised).

Name three IDS/IPS evasion techniques.

Insertion/evasion attacks (sending packets the IDS and host interpret differently), fragmentation (splitting attack payloads across fragments), and obfuscation/encoding (Unicode, polymorphism, encryption) plus session splicing to break signatures across packets.

What is session splicing as an IDS evasion technique?

Splitting the attack payload across many small TCP packets/segments so that no single packet matches an IDS signature, while the target reassembles them into the full malicious request.

Name three firewall evasion techniques.

IP address spoofing and source routing, using tunneling/encapsulation (e.g., HTTP, ICMP, or DNS tunneling and covert channels), and port scanning evasion via fragmentation, decoys, or using allowed ports/proxies to bypass rules.

How can an attacker detect and defeat a honeypot?

Detect via fingerprinting artifacts (e.g., known emulation signatures, missing/abnormal services, virtualization indicators, predictable responses, or tools like Send-Safe Honeypot Hunter). Defeat by avoiding/disabling it or fingerprinting decoy services so real attack traffic is steered away from the trap.

What is a bastion host in firewall architecture?

A hardened, highly secured host placed on the network perimeter (often in the DMZ) that is exposed to untrusted networks and runs minimal services to reduce attack surface while mediating traffic.

What is a DMZ (demilitarized zone) in network perimeter design?

A perimeter network segment that sits between the internal trusted network and the untrusted internet, hosting public-facing servers so that a compromise there does not directly expose the internal network.