Network Attacks: Sniffing, ARP Poisoning, MITM, DDoS, XSS and SQLi

Passive capture observes traffic at an available collection point. Promiscuous mode does not make a switched network send every conversation to one port. Monitor-mode wireless capture depends on radio capability, channel, signal and link configuration.

Active interception changes network behaviour to redirect or influence traffic. ARP manipulation, rogue access points and changes to switching infrastructure are examples, but their feasibility is topology-dependent.

Wireshark, tcpdump and tshark support collection or analysis under their actual configuration. Encryption can leave metadata visible while protecting content. Suitable session secrets can sometimes enable decryption of supported captures; merely setting an environment variable does not guarantee keys or complete plaintext.

A purely passive observer may emit no capture-related packets, but the host can still produce ordinary traffic or leave endpoint records. “Undetectable” is too strong; establish what the particular evidence can reveal.

Collect interface settings, capture filters, loss statistics and observation location. Conduct active validation only within the approved scope and separate any test traffic from the original incident.

Spoofing manipulates an identifier or claim. Distinguish a forged IP source, changed link address, false neighbour binding, misleading DNS answer and presented email identity; each uses different evidence and trust assumptions.

Source-address validation can reduce spoofed traffic when correctly deployed. Do not assume universal implementation by a country’s providers or that an unexpected address must originate abroad.

MAC filtering is not strong device authentication. A locally administered address can reflect legitimate configuration; a vendor-prefix mismatch does not identify an attacker.

For email identity and aligned domain checks, use Email Forensics. DMARC requires an aligned pass, not simply both SPF and DKIM passing or failing together.

ARP resolves IPv4 neighbour information on applicable local links. A malicious false binding can cause traffic for a gateway or peer to reach an unexpected interface. Host acceptance rules and network inspection controls affect whether a forged update works.

If diverted traffic is forwarded, an adversary may remain in the path. This does not automatically decrypt TLS, provide authentication secrets or cover every flow. Partial poisoning can instead cause loss of connectivity.

Investigate a timeline of ARP packets, neighbour caches, switch ports, DHCP assignments and affected traffic. Repeated claims from different MAC addresses are useful leads, but redundancy protocols, migration or misconfiguration can produce similar observations.

ARP inspection and related switch controls depend on trusted-port settings and accurate bindings, including static-address handling. Segmentation limits ordinary ARP scope but is not a complete security boundary when misconfigured or bridged.

ARP is not normally routed between separate broadcast domains. IPv6 uses different neighbour mechanisms and needs its own assessment. State the actual topology rather than infer it solely from a VLAN number.

Preserve the original state before remediation when feasible. Restoring bindings or testing an interception technique changes evidence and must be recorded. Explain observed path changes separately from the inferred actor’s purpose.

DNS abuse can occur through endpoint configuration, an on-path response, resolver compromise, cache manipulation or authoritative account control. Compare answers with the applicable view and time context; two different legitimate responses are not necessarily poisoning.

DNSSEC authenticates appropriately signed DNS data under a chain of trust. Unsigned insecure delegations are not automatically rejected as bogus. Validation failures need the actual status, keys, time and configuration examined.

DoH and DoT protect the client-to-resolver channel when correctly authenticated; they do not make the resolver trustworthy or authenticate every underlying zone. Preserve resolver and client configuration as well as observed transport.

BGP origin validation classifies route origins using RPKI information. It does not authenticate the full path, and “NotFound” differs from “Invalid.” Local policy determines handling; absence of a ROA is not automatically a rejected route.

HTTPS stripping targets an initial insecure interaction or insecure links rather than simply breaking correctly validated TLS. Previously established HSTS or applicable preload policy can protect covered names, subject to actual browser state and scope.

Assess redirects, browser policy, certificate validation and proxy configuration. Do not assume every browser enables one identical HTTPS-only policy or that an interception position alone establishes decrypted access.

OWASP Top 10:2025 is the current named release reviewed for this lesson. Its numbering differs from 2021. Use a version with any category label; the list is awareness guidance, not proof that a technique dominated a particular country’s casework.

XSS causes untrusted content to execute in an unintended browser context. Reflected and stored describe delivery/persistence, while DOM-based describes client-side processing; these labels can overlap. A payload can reach a server even when the vulnerable sink is client-side.

Investigate the original input, response or stored content, vulnerable source-to-sink path and actual execution evidence. A log containing script-like text can represent a blocked attempt or harmless data. HttpOnly can prevent script access to a cookie but does not eliminate every consequence of XSS.

XSS prevention uses context-appropriate output handling, safe sinks and suitable sanitisation for intended HTML. CSP can add protection but does not replace correct handling of untrusted content.

SQL injection occurs when untrusted input changes the intended SQL structure. Union/error-based responses and boolean or timing differences are possible evidence, but they are not an exhaustive set and ordinary latency is not proof of a timing attack.

Parameterised statements separate values from query structure. Dynamic identifiers or query fragments need separate safe design and validation. An ORM does not make arbitrary raw SQL concatenation safe.

CSRF induces unwanted authenticated browser actions under the target’s session behaviour. Tokens, origin checks and correctly configured SameSite cookies can help. Same-site and same-origin differ, and XSS can undermine some CSRF controls.

SSRF induces server-originated requests outside the intended policy. Assess URL parsing, redirects, outbound destinations and sensitive internal services. A metadata endpoint’s availability or IMDSv2 token requirement is not a universal guarantee of exploitability or protection.

XXE depends on the parser resolving external entities or related unsafe resources. Library, version and application configuration determine behaviour; do not assume every modern language stack disables all dangerous XML features.

Preserve relevant request IDs, decoded and raw representations, response status/body where available, database or application events and resulting changes. TLS and logging selection can conceal payloads from some sources. Record attempted and successful actions separately.

Denial of service concerns availability. Investigate bandwidth, packet rate, connection state and application work together with the observed outage or degradation.

Volumetric floods can saturate a link; reflection can direct third-party replies at a forged victim source. Amplification depends on service, query and configuration, so a historical multiplier is not a universal characteristic.

Protocol/state exhaustion can involve incomplete handshakes or other stateful processing. SYN cookies can mitigate particular backlog pressure but do not supply unlimited bandwidth or protect every application resource.

Application-layer floods or slow requests can exhaust resources without exceptional bandwidth. Legitimate traffic surges, software faults and dependency failures can resemble attack symptoms; compare request patterns, service metrics and independent upstream records.

Scrubbing, capacity planning, caching, rate controls and origin protection address different bottlenecks. Remote blackholing sacrifices reachability for a destination, while FlowSpec can express more selective filtering; they are not identical techniques.

Record capture or flow sampling, byte-count semantics, upstream filtering and service impact. Many apparent source IPs can be reflectors, proxies or spoofed values, so distinguish infrastructure from infected devices and operators.

Phishing, pretexting and other social engineering can supply credentials or access used in a network incident. Preserve messages, identity events and endpoint activity rather than assume one common regional campaign explains the case.

A compromised genuine account and a forged identity have different evidence. Correlate access tokens, sessions, configuration changes and independent actions without treating a displayed account name as a person.

A zero-day label concerns the vulnerability’s disclosure or defensive availability in context; it is not established because an analyst found unfamiliar behaviour. Verify the actual software, vulnerable condition and exploitation evidence.

CVE records identify vulnerabilities, and CISA KEV is a useful exploitation-prioritisation source. A vulnerable version or KEV listing alone does not establish that this system was exploited. Avoid fixed catalogue counts that quickly become stale.

Insider-risk findings need authorised role, actual access and supported actions assessed with privacy and employment requirements. An anomaly score or DLP alert is a lead, not proof of intent.

Incident reporting, evidence disclosure and escalation requirements vary by jurisdiction and sector. Keep the technical timeline and preservation record usable for the applicable process.