A broad survey of common network attack types, including denial of service, malware, spoofing, and on-path attacks, with explanations of how each technique works against network infrastructure.
Network Attack Types
One of the most common types of attacks there are is against passwords. That's because there are a lot of bad passwords out there, or passwords that never were changed, or just a lack of passwords altogether. I'll just briefly mention it here, but I'm going to go more in depth into good passwords and good password management later.
The idea behind denial of service is that you're doing something to a service that brings it down, hence the denial part. Let's say we have a server right here and it's running some sort of service. Maybe it's a web browser, or maybe it's something else. This computer right here is going to try to attack it. It's going to leverage some sort of protocol inefficiency, or just flat out send enough traffic to this device right here that the device gets overwhelmed and then can't send out traffic to anyone else. Essentially, what this is doing is affecting the availability of the service or the server. This could be as simple as this computer sending out too many pings to this computer right here and flooding it with all of these ping requests, and now it's not able to serve out the services to anyone else.
The problem is that this type of attack is actually very simple to send and to get going. It's very easy to implement, it will bring the system down, and it's hard to mitigate against it. It's difficult to eliminate this issue, and when people are just starting out, hacking and experimenting around, this is one of the common ones that they'll start out with.
Another one that we will see is the DDoS, where the extra D is distributed: distributed denial of service. It's the same concept as before, but the idea is that you have multiple machines that are sending out and overwhelming this one machine. This is a little more likely, because sometimes it's hard for one machine to send enough traffic to a web server to overwhelm it. But it wouldn't take very many machines sending the same requests to this machine to cause this server to go down.
One way that this could be leveraged is that these might be owned by all one person, but sometimes hackers will go and hack systems, or distribute some sort of malware that goes onto all the machines and then will launch code. So between botnets and command and control, they will then notify everyone that it's time to launch this attack and this is who I want you to launch the attack against, and it will launch the attack and bring the system down. Essentially this builds a bunch of zombie hosts that are out here that are going to do the attack, and then instructs them at the same time to do the attack, to do a distributed denial of service attack.
Malware is different types of programs that are distributed and then cause all sorts of problems. An example of this is the virus. The virus starts replicating itself and starts infecting different machines, and just gets passed from machine to machine. Ultimately what it's trying to do is maybe alter some sort of code, or corrupt some sort of data, or just delete files altogether. It can cause computer booting issues. It can capture sensitive information and then send it to whoever created the virus. It can access and use email accounts. It can do a lot of different things, or it could even lie dormant, and then once it is called by something, it becomes alive. This malware virus can be pretty tricky, and that's one reason why you have to be scanning your computer for any kind of malware that might be installed on it.
Another type is the worm. A worm's job is just to replicate itself. Where a virus might be installed into some sort of other code and get installed in other code, a worm's job is just to replicate itself and stay standalone, not necessarily injecting itself into other software, but just to keep replicating itself. It can fill up drives and bring systems down because it replicates itself so much.
Then we have the Trojan horse. The Trojan horse is similar to the old story about the army being in the Trojan horse: they got behind the gates and then stormed the city and took over the city. Well, that's the idea behind this. It's a piece of software that looks legitimate on the outside. Maybe you're signing into some sort of service like Office 365 or Gmail, and it looks like you're signing into that service, but in fact you're signing into this other software, and that software is then taking your credentials and shipping them out and sending them to somebody. That way, now they have your Gmail account or your Office 365 account, or whatever it's designed to look like. That's the Trojan horse: it's designed to look like something legitimate when it in fact is not legitimate.
I've talked about the importance of encrypting your drive, but this is not the way we want to do it, and that is with ransomware. The idea behind ransomware is that it will encrypt the drive on your machine. Now you don't have access to your information, they're holding it hostage, and they won't give you the key to unencrypt it until you pay them a certain amount of money.
The problem with this is that it's not just your machine that is at risk. Let's say this machine right here is remoted in and connected into a file server over here, and has access to all of these files and write access to those files, and this computer gets infected with ransomware. It could encrypt this data as well, causing all sorts of problems not just to this one user but to other users as well. This is one of the reasons why we want least privilege: you need to have the least amount of access to whatever devices you possibly can, or whatever resources you possibly can, so this stuff can't get leveraged like this. Ransomware can be especially dangerous, and the solution for this is really to back up your systems and make sure you have a backup copy of your systems.
Another thing hackers will use is trust exploitation. Let's say in this example I have a network right here, and let's say this server right here trusts this machine right here, but perhaps it doesn't trust anything outside its network right there. This machine, even though it doesn't have access to the server, does have access to this machine right here. So what this machine can do is jump onto this machine, and now it has access to this server, because the server trusts this machine right here.
On a very similar note, we have port redirection. In fact, this is a type of trust exploitation. In my last example, this machine right here had trusted this computer right here. In this example right here with port redirection, let's say this machine has RDP access to this machine. It does a remote desktop protocol into this machine, and this is on port 3389, and now it has remote control over this machine. Then it uses an SSH program to SSH into here, and that is on port 22. So it's redirecting from port 3389 to port 22 to get onto this machine right here.
Sometimes attackers will use this on path, and so they will insert a piece of equipment on the path in between one device and another so that it can capture data, or it can do some sort of changing of the data. It used to be called man-in-the-middle, so most of the time you'll see this called a man-in-the-middle attack, but you also will see this now called on path.
We have a machine right here and maybe it wants to access this web server right here. Maybe this is even banking software. The idea behind on path, or man-in-the-middle, is that you set up a piece of equipment, and instead of this request going all the way out to this server over here, that request gets captured and sent to this device right here. This device may go and grab the information — remember, this is maybe the bank information — and bring back the web page, but maybe make a couple of alterations to it. So rather than the data going to this device right here, the data is going to stay local here. Maybe it's grabbing a username and password, maybe it's grabbing account balances, maybe it's just listening and seeing what's going on. Maybe it's trying to trick the end user into entering personal information, once again bank account information, and maybe trying to steal money out of the bank account. So that's the on path, or man-in-the-middle.
One way to initiate this on path or man-in-the-middle is using a rogue DHCP server. An example of this is that maybe this network has a DHCP server already on it, but I install my own DHCP server onto this network. What happens is that when this machine makes a request for an IP address, the machine gives it an IP address that can work on this network, but also says, I am your router, so everything goes through me; or, I am your DNS server, so everything goes through me. It could really specify anything through this, since it's getting all of its information from the DHCP server. So it could really control what this device is using. It could say, "I'm your router. Send all traffic to me." And then, once again, similar to a man-in-the-middle attack, it goes out there and finds the data and presents it back. Now it can be listening to all the traffic and figuring out what's going on, listening to passwords and seeing what the usernames and passwords of these different sites are, maybe presenting the user with some different information, leveraging this rogue DHCP server to hack the systems here.
Then we have a rogue access point. I've seen this before too, where somebody doesn't like the access points that the company has, and so they'll plug in their own access point into the network and then they will use that access point instead to connect into. The problem with this is that this rogue access point does not necessarily have the same security as you want on your networks, and it can cause all sorts of problems. So now maybe they have something like WEP, which is considered insecure, that's operating on the network. Anybody can break this and connect into this, and now they have access to the whole network and the whole network is compromised. So a rogue access point can be pretty devastating to your network.
An evil twin does have to do with access points, but it's a little different. In an evil twin scenario, I'm going to set up a network on my own access point. This access point is going to then pretend like it's part of this network, hoping that clients will connect to it instead. And now you can perform this man-in-the-middle attack again, or this on path attack, because all the traffic is going through this other network that you didn't realize what it was connecting to. So an evil twin is trying to mimic whatever the real network access point is supposed to be, trying to mimic that so that way it can trick clients into accessing it instead. You see this a lot at coffee shops, where they'll have evil twin access points at coffee shops, and it will look like the coffee shop access point, but in fact it is something illegitimate.
Spoofing happens when some device pretends to be another device. Let's say we have a server right here and this machine is trying to connect to this server, but somehow this machine is spoofing, or pretending to be, this server. There are several different ways that this device might go about pretending to be this device right here.
If this server has an IP address of 192.168.0.5, and this computer right here sends out an ARP request trying to find out the MAC address of this server, of this IP address right here, then this machine may reply back and say, "Oh, that belongs to me and here is my MAC address." Once this machine learns of that MAC address, it might have a hard time disassociating with that MAC address, thinking that it's communicating to this server when in fact it's communicating to this device over there. So that's ARP spoofing.
MAC spoofing has a similar effect, but it goes about it a little differently. Let's say this device right here has some sort of MAC address on it, and this device mimics that MAC address. What's going to happen is that as it sends out messages, this switch is going to think that that MAC address is on a different port and start sending traffic to this device rather than this device. So that is going to be a problem with MAC spoofing, and therefore anything that's going and heading towards this server will now be redirected towards this computer right here.
IP spoofing can also have a similar effect, but once again in a little different manner. Let's say this address right here is also set on this laptop right here. Now some of the traffic that's supposed to be destined for this server right here would then get sent to this laptop right here. And that's IP spoofing.
DHCP spoofing is a device on your network that is spoofing as a DHCP server. It's pretending to be a DHCP server, so it's really similar to what a rogue DHCP server is. If you set up a separate rogue DHCP server that's responding, that's kind of the same concept. It's a device that, when a DHCP request is being sent out and gets broadcasted out in all the directions, responds back with, okay, here's an IP address for you, also use this DNS, also use this router. Now it has control over its networking traffic, and so maybe it set up this device as being the router, so everything is now going to go to this device rather than to the actual router on the network. So that's DHCP spoofing: a device that pretends that it is, or responds back to, the DHCP requests and hands out these IP addresses even though it's not authorized to do so.
With IP version 6, we have the router solicitation and router advertisement. If this machine is sending out a router solicitation and then that router responds back with a router advertisement, it gives this machine the necessary information on how to get out to the outside world. But if maybe this device right here is pretending to be a router, then it could send out its router advertisement to this machine right here, and then this machine might start sending traffic to this device rather than the actual router. So that's router spoofing: when a device pretends to be a router by responding to router advertisements.
Then we have DNS poisoning, or DNS spoofing. The idea behind this is that maybe this machine is trying to access a resource on the internet, and that is attached to some sort of domain name, so it needs to do a DNS resolution. It asks its DNS server; let's say the DNS server is right there. And then somewhere along the way, that DNS response gets altered to a different IP address. It's not the IP address of the resource that's out there on the internet, but maybe it's even this local address right here. So the DNS record that comes back now is of this machine right here, and this machine starts redirecting traffic to the wrong location. The key to this is that the DNS response has been altered, and now it is pointing to the wrong resource and it's not getting to where it needs to go.
Generally, what happens when you are encrypting traffic between two devices is that you're using keys. There are a few different keys that you actually use through this process, but for this purpose right here, what we're going to say is that this computer right here is trying to talk to this server right here. It's trying to create a secure connection, and it's using keys to do that. First of all, it uses the private key that this server has on the machine to help encrypt the traffic that's going between these two devices, so it'll use this private key to help with that process. Maybe what happens is it will use that private key to establish this communication, but then what it will do is create a session key that it will utilize for this direct communication back and forth.
So what a compromised key will be is if this private key were to be compromised — that would be really bad — or if the session key were to be compromised. Then any traffic that's going back and forth between these two devices can be seen and unencrypted. Whoever is seeing this traffic go back and forth can be able to read that traffic with this private key and session key, or insert themselves within this communication and do a man-in-the-middle attack. So this is the compromised key: when a private key or a session key is compromised and now that traffic is no longer secure.
A deauthentication attack is when a device is talking to a wireless access point. These two devices are talking, and then there's another device that will send a deauthentication signal back to this wireless, saying I want to disconnect, and then it will disconnect this connection. This laptop is no longer connected to this access point. So it's a type of denial of service, because now this computer doesn't have access to this network.
We talked about segmenting your networks for security purposes, splitting up the traffic for your different operations, your different departments. That way sales has access to their resources, operations have access to their resources, and administration has access to the resources. One way we can do this is through VLANs, and we can create VLANs. But what can happen is this thing called VLAN hopping, and VLAN hopping allows maybe sales to get somewhere into operations, or operations somewhere into administration, and vice versa. So this is what VLAN hopping is concerned with, and it's a weakness in one of the protocols, in one of the technologies that are used.
We talked about a lot of different network vulnerabilities, common network vulnerabilities. It included things like password attacks, denial of service, distributed denial of service, malware, ransomware, trust exploits, on path attacks, spoofing, compromised key attacks, deauthentication, VLAN hopping, port redirection, and a few more. There are a lot of different ways that hackers can hack your network or take advantage of weaknesses within technologies and weaknesses within protocols. This is all important to keep in mind as you're building out your networks. There are different ways to mitigate these issues, to either eliminate them or lessen the impact they have on your networks. But the most important thing is that you make sure that you take a conscious effort to understand what your network is doing and understand what the weaknesses are, figuring out what your risks are and starting to compensate for those risks. Start mitigating those risks.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →