CompTIA Security+ Preparation · lesson 18 of 45 · 25 min
Denial of Service Attacks
DoS (Denial of Service) — overwhelms a target to make it unavailable. Single source.
DDoS (Distributed DoS) — uses a botnet (thousands of sources) to amplify the attack. Much harder to block.
Volumetric attacks — flood bandwidth (UDP flood, ICMP flood, DNS amplification). Measured in Gbps.
Protocol attacks — exploit protocol weaknesses. SYN flood: sends TCP SYN without completing handshake, exhausting the server’s connection table.
Application layer attacks — target specific applications. HTTP flood, Slowloris (opens many connections, sends partial requests slowly).
Amplification attacks — attacker sends small requests to open servers (DNS, NTP) with spoofed source IP (victim’s IP). Servers send large responses to the victim. DNS amplification: 50–70× amplification factor.
Mitigation: rate limiting, SYN cookies, blackhole routing, scrubbing centers, ingress filtering (BCP38).
On-Path, Replay, and Spoofing Attacks
On-path attack (MITM) — attacker intercepts and potentially modifies communications between two parties. Methods: ARP poisoning, DNS spoofing, SSL stripping, BGP hijacking.
ARP poisoning — sends fake ARP replies to associate attacker’s MAC with a legitimate IP. Victims send traffic to the attacker. Mitigation: Dynamic ARP Inspection (DAI).
DNS poisoning (cache poisoning) — injects false DNS records into a resolver’s cache. Victims are redirected to malicious sites. Mitigation: DNSSEC.
SSL stripping — downgrades HTTPS to HTTP. Mitigation: HSTS (HTTP Strict Transport Security).
Replay attack — captures valid authentication data and retransmits it. Mitigation: timestamps, nonces, sequence numbers.
IP spoofing — forges the source IP address to impersonate another host or bypass IP-based controls.
MAC spoofing — changes the MAC address of a network interface to impersonate another device or bypass MAC-based controls.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Network Attacks
A SYN flood attack targets:
- DNS servers
- The TCP connection table by sending SYN packets without completing the handshake
- HTTP applications
- ARP caches
- Answer: The TCP connection table by sending SYN packets without completing the handshake
SYN floods fill the server’s half-open connection table — the server waits for ACKs that never come, exhausting resources. DNS amplification works by: Flooding DNS servers with queries Sending small queries with the victim’s spoofed IP — DNS servers send large responses to the victim
- Poisoning DNS caches
- Blocking DNS resolution
Answer: Sending small queries with the victim’s spoofed IP — DNS servers send large responses to the victim The attacker spoofs the victim’s IP as the source — open DNS resolvers send large responses to the victim, amplifying the attack. HSTS (HTTP Strict Transport Security) mitigates:
- SQL injection
- SSL stripping attacks
- DDoS attacks
- ARP poisoning
- Answer: SSL stripping attacks
HSTS tells browsers to always use HTTPS — even if an attacker tries to downgrade to HTTP, the browser refuses. DNSSEC mitigates:
- DDoS attacks
- DNS cache poisoning
- ARP poisoning
- SSL stripping
- Answer: DNS cache poisoning
DNSSEC digitally signs DNS records — resolvers can verify the authenticity of responses, detecting injected false records. A replay attack is mitigated by:
- Encryption alone
- Timestamps and nonces in authentication messages
- Strong passwords
- Firewalls
- Answer: Timestamps and nonces in authentication messages
Timestamps and nonces ensure each authentication message is unique — captured messages cannot be reused. Dynamic ARP Inspection (DAI) mitigates:
- SYN floods
- ARP poisoning
- DNS spoofing
- Replay attacks
- Answer: ARP poisoning
DAI validates ARP packets against the DHCP snooping binding table — drops packets with invalid MAC-IP mappings. Slowloris is a type of:
- Volumetric DDoS
- Application layer DoS
- Protocol attack
- Amplification attack
- Answer: Application layer DoS
Slowloris opens many HTTP connections and sends partial requests slowly — keeps connections open, exhausting the web server’s connection pool. BCP38 (ingress filtering) mitigates:
- XSS attacks
- IP spoofing by requiring ISPs to block packets with spoofed source IPs
- DNS poisoning
- Buffer overflows
- Answer: IP spoofing by requiring ISPs to block packets with spoofed source IPs
BCP38 requires ISPs to drop packets with source IPs that cannot originate from their network — reduces IP spoofing effectiveness. CompTIA Network+ uses “on-path attack” to replace the older term:
- DoS attack
- Replay attack
- Man-in-the-Middle (MITM)
- Amplification attack
- Answer: Man-in-the-Middle (MITM)
CompTIA updated terminology — “on-path attack” describes an attacker positioned between communicating parties. SYN cookies mitigate SYN flood attacks by:
- Blocking all SYN packets
- Not allocating resources until the three-way handshake is complete
- Rate limiting all connections
- Encrypting SYN packets
- Answer: Not allocating resources until the three-way handshake is complete
SYN cookies encode connection state in the SYN-ACK — the server only allocates resources when the client sends the final ACK.
Previous lesson: Application attacks: SQL injection, XSS, CSRF, buffer overflow, directory traversal
Back to CompTIA Security+ Preparation
Next lesson: Vulnerability management lifecycle: identify, prioritize, remediate, verify