Way To Hackintosh : Types of Attacks on Web Servers

<div dir="ltr" style="text-align: left;" trbidi="on">
<h3 class="post-title entry-title" itemprop="name">
Types of Attacks on Web Servers
</h3>
<div class="post-header">

</div>
Some of the more popular attack methods are described below. 
 
FTP Bounce Attack 
 
FTP (File Transfer Protocol) is used to transfer documents and data 
anonymously from local machine to the server and vice versa. All 
administrators of FTP servers should understand how this attack works. 
The FTP bounce attack is used to slip past application-based firewalls. 
 
In a bounce attack, the hacker uploads a file to the FTP server and 
then requests this file be sent to an internal server. The file can 
contain malicious software or a simple script that occupies the internal
 server and uses up all the memory and CPU resources. 
 
To avoid these attacks, the FTP daemon on the Web servers should be 
updated regularly. The site FTP should me monitored regularly to check 
whether any unknown file is transferred to the Web server. Firewalls 
also help by filtering content and commands. Some firewalls block 
certain file extensions, a technique that can help block the upload of 
malicious software. 
 
Port Scanning Attack 
 
A port scan is when someone is using software tosystematically scan the
 entry points on other person’s machine. There arelegitimate uses for 
this software in managing a network. 
 
Mosthackers enter another’s computer to leave unidentifiable harassing 
messages,capture passwords or change the set-up configuration. The 
defense for this isthrough, consistent network monitoring. There are 
free tools that monitor forport scans and related activity. 
 
Ping Flooding Attack 
 
Pinging involves one computer sending a signal to anothercomputer 
expecting a response back. Responsible use of pinging 
providesinformation on the availability of a particular service. Ping 
Flooding is theextreme of sending thousands or millions of pings per 
second. Ping Flooding cancripple a system or even shut down an entire 
site. 
 
APing Flooding Attack floods the victim’s network or machine with IP 
Pingpackets. At least 18 operating systems are vulnerable to this 
attack, but themajority can be patched. There are also numerous routers 
 and printers that arevulnerable. Patches cannot currently be applied 
throughout a global networkeasily. 
 
Smurf Attack 
 
A Smurf Attack is modification of the "ping attack"and instead of 
sending pings directly to the attacked system, they are sent to 
abroadcast address with the victim’s return address. A range of IP 
addressesfrom the intermediate system will send pings to the victim, 
bombarding thevictim machine or system with hundreds or thousands of 
pings. 
 
One solution is to prevent the Web server from being usedas a 
broadcast. Routers must be configured to deny IP-Directed broadcasts 
fromother networks into the network. Another helpful measure is to 
configure therouter to block IP spoofing from the network to be saved. 
Routers configured assuch will block any packets that donor originate in
 the Network.To be effective this must be done to all routers on the 
network. 
 
SYN Flooding Attack 
 
This attack exploits vulnerability in the TCP/IPcommunications 
protocol. This attack keeps the victim machine responding back toa 
non-existent system. The victim is sent packets and asked to response to
 asystem or machine with an incorrect IP address. As it responds, it is
 floodedwith the requests. The requests wait for a response until the 
packets begin totime out and are dropped. During the waiting period, the
 victim system isconsumed by the request and cannot respond to 
legitimate requests. 
 
When a normal TCP connection starts, a destination hostreceives a SYN 
(synchronize/start) packet from a source host and sends back aSYN ACK 
(synchronize acknowledge) response. The destination host must the 
hearan acknowledgement, or ACK packet, of the SYN ACK before the 
connection isestablished. This is referred as the "TCP three-way 
handshake”. 
 
Decreasingthe time-out waiting period for the three way handshake can 
help to reduce therisk of SYN flooding attacks, as will increasing the 
size of the connectionqueue (the SYN ACK queue). Applying service packs
 to upgrade older operatingsystems is also a good countermeasure. More 
recent operating systems areresistant to these attacks. 
 
IPFragmentation/Overlapping Fragment Attack 
 
To facilitate IP transmission over comparatively congestednetworks. IP 
packets can be reduced in size or broken into smaller packets. Bymaking
 the packets very small, routers and intrusion detection systems 
cannotidentify the packets contents and will let them pass through 
without anyexamination. When a packet is reassembled at the other end, 
it overflows thebuffer. The machine will hang, reboot or may exhibit no 
 effect at all. 
 
Inan Overlapping Fragment Attack, the reassembled packet starts in the 
middle ofanother packet. As the operating system receives these invalid
 packets, itallocates memory to hold them. This eventually uses all the
 memory resources andcauses the machine to reboot or hang. 
 
IPSequence Prediction Attack 
 
Usingthe SYN Flood method, a hacker can establish connection with a 
victim machineand obtain the IP packet sequence number in an IP Sequence
 Prediction Attack.With this number, the hacker can control the victim 
 machine and fool it intobelieving it’s communicating with another 
network machines. The victim machinewill provide requested services. 
Most operating systems now randomize theirsequence numbers to reduce the
 possibility of prediction. 
 
DNSCache Poisoning 
 
DNS provides distributed host information used for mappingdomain names 
and IP addresses. To improve productivity, the DNS server cachesthe 
most recent data for quick retrieval. This cache can be attacked and 
theinformation spoofed to redirect a network connection or block access
 to the Web sites),a devious tactic called DNS cache poisoning. 
 
The best defense against problems such as DNS cachepoisoning is to run 
the latest version of the DNS software for the operatingsystem in use. 
New versions track pending and serialize them to help preventspoofing. 
 
SNMP Attack 
 
Most network devices support SNMP because it is active bydefault. An 
SNMP Attack can result in the network being mapped, and traffic canbe 
monitored and redirected. 
 
The best defense against this attack is upgrading toSNMP3, which 
encrypts passwords and messages. SinceSNMP resides on almost all network
 devices, routers, hubs, switches, Servers andprinters, the task of 
upgrading is huge. Some vendors now offer an SNMP Managementtool that 
includes upgrade distribution for global networks. 
 
UDP Flood Attack 
 
AUDP Flood Attacks links two unsuspecting systems. By Spoofing, the UDP
 floodhooks up one system’s UDP service (which for testing purposes 
generates aseries of characters for each packet it receives) with 
another system’s UDPecho service (which echoes any character it receives
 in an attempt to testnetwork programs). As a result a non-stop flood 
of useless data passes betweentwo systems. 
 
Send Mail Attack 
 
In this attack, hundreds of thousands ofmessages are sent in a short 
period of time; a normal load might only be 100 or1000 messages per 
hour. Attacks against Send Mail might not make the front page,but 
downtime on major websites will. 
 
For companies whose reputation dependson the reliability and accuracy 
of their Web-Based transactions, a DoS attackcan be a major 
embarrassment and a serious threat to business. 
 
Conclusion 
 
Frequent denial-of-service attacks and achange in strategy by 
"Black-Hat Hackers" are prompting enterprises todemand technology that 
proactively blocks malicious traffic. 
 
Tools and services that reflectapproaches to combat such DoS attacks 
have been introduced with time. These arenormally upgrades to what was 
produced before. No solution is ever said to be anultimate solution to 
defend DoS attacks. Despite the new technology coming everyday, the 
attacks are likely to continue.  </div>