TechKnowSurge
TechKnowSurge Catalog Videos Common Protocol Vulnerabilities
VideoSecurityFree

Common Protocol Vulnerabilities

Many network protocols in use today were designed before security was a priority, leaving them vulnerable to attacks like spoofing, session hijacking, and denial of service. Even protocols with secure alternatives are often still deployed in their original, unencrypted forms.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network protocols are a fundamental source of vulnerability in modern infrastructure, largely because many of them were designed decades ago when security was not a central design requirement. Protocols like IPv4, HTTP, FTP, SMTP, and IMAP have well-documented weaknesses, and while secure versions or successors exist, the transition away from legacy implementations has been slow. IPv6 offers improvements over IPv4, and HTTPS has largely replaced HTTP in many contexts, but unencrypted servers and outdated addressing schemes remain common across real-world networks. Each layer of the OSI model carries its own set of strengths and weaknesses, and the application layer in particular continues to introduce risk through insecure protocol design. Even where newer protocols have addressed some historical flaws, significant threats persist. Modern networks remain susceptible to denial of service and distributed denial of service attacks, address spoofing, adversary-in-the-middle attacks, and session hijacking, all of which exploit weaknesses that have existed for years and have not been fully resolved. Understanding where these vulnerabilities originate at the protocol level is essential to assessing and hardening network security.

What you'll learn

What's covered

Insecure Network Protocols

Key terms

Open Systems Interconnection Model
OSI
A conceptual framework that standardizes network communication into seven distinct layers.
Application Layer
The topmost layer of the OSI model (Layer 7) that provides network services directly to end-user applications.
File Transfer Protocol
FTP
A standard network protocol used to transfer files between a client and a server over a TCP network.
Transport Layer Security
TLS
A cryptographic protocol that provides secure communication over a network, successor to SSL.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Session Hijacking
An attack in which a threat actor takes over an authenticated session by stealing or forging the session token, gaining unauthorized access to resources without needing the user's credentials.

Topics

Network Protocols Protocol Vulnerabilities Osi Model Denial Of Service Spoofing Session Hijacking Networking

Transcript

Another thing that can make our networks insecure is the protocols that are running across them. The protocols themselves could be the problem.

Here's the OSI model. We have many different layers to this OSI model, and each one of these layers has both pros and cons to it, their strengths and their weaknesses. Some of their strengths are their weaknesses.

A lot of these protocols, like IP version 4, are very old protocols, from when security was not as big of a concern. For instance, we're using IP version 6 now, and we have IP version 6 out there, which is a little more secure and a little better way of doing IP addressing. But the problem is that we haven't switched over. We're still stuck on this IP version 4.

A lot of our protocols are this way. We see HTTP, FTP, SMTP, IMAP, and we have secure versions of these because we know that security needs to be implemented. We're making good headway in some of these protocols, like HTTP — most of the time we're using HTTPS — but there still are these HTTP servers out there which cause problems, which are insecure in the nature of it because it's not encrypted. This can be problematic.

There's also layer 7, the application layer. There are application layer protocols that we use that can also be insecure, and that can be problematic as well.

Even with the newer protocols, we still have some problems. There are things that are out there that are susceptible to denial of service attacks, distributed denial of service attacks, address spoofing, adversary in the middle attacks, session hijacking — things that we've overcome in some ways but still are difficult. So some of these technologies are still susceptible to some of these old style attacks.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →