3.1 - Network Vulnerabilities and Attacks
Common Network Attacks
ARP Poisoning and On-Path Attacks
ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network, so devices know which physical hardware matches which logical address. Normally, a device asks "who has this IP address," the matching device responds with its MAC address, and the asking device stores that mapping to use going forward.
On a LAN, the default gateway (usually the router that connects the LAN to other networks, like the internet) uses ARP to build an ARP table that pairs each device's IP address with its MAC address. When traffic for a device on the LAN arrives, the gateway looks up that device's IP address in the table to find which MAC address to deliver it to.
ARP poisoning exploits the fact that ARP doesn't have any built-in authentication. An attacker figures out the target's IP and identity, then sends forged ARP responses claiming that IP is actually associated with the attacker's own MAC address (a trick called MAC spoofing). Devices update their tables with this false info, so traffic meant for the real target instead flows to the attacker, who can read it, change it, forward it, or just drop it entirely.
When the falsified ARP packets go to the default gateway, the gateway's ARP table ends up linking the target's IP address to the adversary's MAC address, so the gateway delivers the target's traffic to the adversary's device.
Example: here's a default gateway's ARP table before and after an adversary at
192.168.1.35 poisons it to intercept traffic meant for the file server at 192.168.1.20.Before IP address MAC address 192.168.1.20 00:00:5e:00:53:20 (file server) 192.168.1.35 00:00:5e:00:53:35 (adversary's laptop) After the falsified ARP packets IP address MAC address 192.168.1.20 00:00:5e:00:53:35 <- file server's IP now points to the adversary 192.168.1.35 00:00:5e:00:53:35
Now anything the gateway delivers to
192.168.1.20 goes to the adversary's laptop instead. Notice that one MAC address now shows up twice in the table. That duplicate is the clue used to detect ARP poisoning in 3.5.Example: an attacker wants to intercept traffic between a workstation and a file server. They send forged messages telling each device that the other one's address is really the attacker's own MAC address. Both devices update their tables with the lie, so when the workstation sends files to what it thinks is the server, the traffic actually goes to the attacker first, who copies anything sensitive before quietly forwarding it along so neither side notices anything happened.
This sets up what's called an on-path attack, or man-in-the-middle attack, where the attacker sits between two parties, intercepting and potentially altering their communication without either side knowing. This enables reading confidential info, stealing credentials or financial data, altering messages before they arrive, or hijacking an authenticated session entirely.
Example: an employee logs into a company banking portal to authorize a payment. An attacker using ARP poisoning intercepts the session, lets the login go through normally, but quietly swaps the destination account number on the payment before forwarding it to the bank, altering a legitimate transaction without the employee ever knowing.
MAC Flooding
Switches normally keep a table (called a CAM table) mapping MAC addresses to physical ports, so traffic only goes to the specific port it's actually meant for, keeping things efficient and reasonably private.
MAC flooding overwhelms that table by sending a flood of frames with different fake source addresses, exhausting the switch's memory. Once the table's completely full, the switch can't learn any more legitimate mappings, so it falls back into a "fail open" broadcast mode, sending everything to every port like a basic hub instead of a smart switch. An attacker sitting in promiscuous mode on that network then captures all the broadcasted traffic.
Example: an attacker floods a corporate network switch with 100,000 frames per second, each carrying a random fake source address. Within 30 seconds the CAM table fills up completely, and the switch starts broadcasting everything to everyone, letting the attacker capture other people's email, database queries with customer info, internal chats, and file transfers, then sift through it all for anything valuable like credentials or financial data.
This kind of attack is a form of eavesdropping or sniffing, capturing data as it moves across the network. It works because a lot of switches are designed to prioritize keeping communication flowing over strict security, so when their table fills up, they'd rather broadcast everything than stop working, accidentally creating a huge vulnerability.
DNS Poisoning and Credential Harvesting
DNS translates human-friendly domain names into the IP addresses computers actually use, relying on authoritative servers for definitive answers, recursive resolvers to look things up on a client's behalf, and caching to speed up repeat lookups.
DNS poisoning injects false records into a DNS server or cache to redirect people toward malicious sites. An attacker picks a target domain (like an online bank), builds a fake copy of the site, sends forged responses pretending to be the real authoritative server, and gets the DNS server to cache the lie, like pointing the bank's domain to the attacker's own server. Anyone who looks up that domain gets sent to the fake site, where entering login credentials hands them straight to the attacker.
Example: an attacker poisons a company's internal DNS so their email domain points to the attacker's server instead of the real one. Employees trying to check email land on a near-perfect fake login page, and when they enter their username and password, the attacker captures it, then shows a fake "service temporarily unavailable" message so nobody suspects anything right away.
This is called credential harvesting, tricking people into entering real login info on a fake page. Warning signs include slightly misspelled URLs, HTTPS certificates that don't match the actual domain, login pages showing up on unexpected domains, or requests for unusually specific info during login.
Smurf Attacks and Denial of Service
ICMP (Internet Control Message Protocol) handles network diagnostics like the "ping" command, which sends an echo request and expects an echo reply back.
A smurf attack abuses ICMP along with network broadcast addresses to amplify traffic. The attacker finds a network with broadcast addressing enabled, spoofs an ICMP request to look like it's coming from the victim's IP, and sends it to that network's broadcast address. The network then relays that request to every device on it, and all of them reply straight to the victim, who receives a flood of replies for requests they never actually made, overwhelming their connection.
If an attacker sends one spoofed request to a broadcast address covering 100 devices, the victim gets 100 replies, a 100 to 1 amplification.
Example: an attacker targeting an online retailer's web server identifies 50 networks with broadcast addresses enabled, each with around 200 devices, and spoofs requests to all of them using the retailer's IP as the source. That's 10,000 replies flooding in from a single round, and repeating this continuously generates millions of packets that completely swamp the victim's connection, making the site totally inaccessible to real customers.
This falls under denial of service (DoS), attacks that make a system or resource unavailable to legitimate users by consuming bandwidth, exhausting resources like CPU or memory, crashing services with malformed requests, or otherwise blocking access. A distributed denial of service (DDoS) uses many devices attacking at once, often through a botnet of compromised machines, making the attack much bigger and much harder to block since stopping one source still leaves thousands more.
Example: an attacker controlling a botnet of 50,000 hijacked IoT devices commands them all to simultaneously flood a news website with requests. The site's servers, built to handle 10,000 concurrent users, get hit by 50,000 sources at once and crash, taking the site down for hours.
How Adversaries Exploit Network Vulnerabilities
Firewall Vulnerabilities
Without a firewall, or with one that's poorly configured, attackers can send malicious packets directly at internal systems, scan ports to map out the network, launch DoS attacks internally, or spoof legitimate devices to slip past weak authentication. Misconfigured firewalls with overly loose rules create similar problems, like allowing unnecessary services, permitting traffic from untrusted sources, missing known malicious IP ranges, or not inspecting packet contents at all.
Example: a small business with no firewall gets scanned by an attacker who maps out every active device, running service, OS, and app version on their network, all recon that a properly configured firewall would've blocked by dropping unsolicited traffic from outside.
Lateral Movement on LANs
Once one device is compromised, attackers try to reach others on the same local network to expand their access. This works because a lot of organizations focus heavily on perimeter security while internal segmentation stays weak, devices on the same LAN can often talk directly without passing through any real security checks, and reused passwords mean stolen credentials from one device often work elsewhere too.
Example: an attacker phishes a marketing employee, then scans the local network from their compromised machine and finds a file server, a database server, and a domain controller. Extracting cached credentials reveals the employee recently accessed the file server, which the attacker then reaches and finds IT documentation with admin passwords inside. Those credentials get them into the domain controller, giving them control of the entire network, all starting from a low-value marketing workstation.
Physical Network Access via Data Ports
Unsecured network ports let anyone with building access plug straight into the internal network. Without port security, a switch will accept and grant access to just about any device connected to it.
Example: an attacker posing as a vendor gets temporary building access, finds an unused network port in a conference room, and plugs in a laptop, getting granted network access instantly with no authentication required. From there they're already inside the perimeter, free to launch DoS attacks, do MAC flooding, spoof devices, access internal resources, or set up persistent remote access. Port security that requires MAC address authentication would deny unrecognized devices or isolate them onto a separate network, preventing exactly this.
Wireless Signal Leakage
Wireless signals don't respect walls or property lines, often extending into parking lots or nearby buildings, letting attackers interact with a network without ever setting foot inside. From beacon frames alone, an attacker can learn the network name, what encryption is used, supported data rates, and channel info, and by measuring signal strength they can find the best spot to attack from.
Beacon frames are the announcements a wireless access point (WAP) broadcasts about 10 times a second so nearby devices can find the network. Each one carries the network's name (its SSID) and the encryption protocols it uses. Anyone in range can pick them up without joining, so a WAP whose signal reaches past the building is handing this information to people the physical security was supposed to keep out.
Example: an attacker parks outside a law firm with a laptop and a high-gain antenna, picking up the firm's signal from 100 meters away in the parking lot. The beacon frames reveal the network name and that it's using WPA2 with a pre-shared key, giving the attacker everything needed to attempt password guessing, capture handshakes for offline cracking, eavesdrop if encryption breaks, or set up an evil twin, all without ever entering the building.
Unauthenticated Network Access
Networks that don't properly authenticate devices before granting access make it trivially easy for an attacker to join and start attacking from the inside, whether through open networks with no password, weak pre-shared keys that are easy to guess or crack, missing 802.1X authentication, or no device fingerprinting to verify who's actually connecting.
Example: a coffee shop offers free open Wi-Fi, and an attacker connecting realizes the point-of-sale terminals, back-office computers, and security cameras all sit on that same network. From there they can launch attacks directly against those internal systems, something that proper network segmentation and authentication would have prevented.
Rogue Access Points
Attackers can plant unauthorized wireless access points on open network ports, giving themselves a wireless backdoor into the internal network. They gain building access somehow, find an unused port, plug in a small hidden access point, and from that point on can access the internal LAN wirelessly from outside the building, completely bypassing firewalls and perimeter security.
Example: someone visiting for a job interview excuses themselves to the restroom, finds an unused port in a vacant office, and connects a hidden access point in about 90 seconds. Days later, sitting in their car outside, they connect to that hidden network and have full internal access, able to reach servers, exfiltrate data, move laterally, and maintain access for months, all without ever physically being inside again. Small, well-hidden access points like this can go undetected for a long time without wireless intrusion detection in place.
Wireless Encryption Attacks
Attackers try to break wireless encryption to intercept or steal data. Old WEP encryption has fundamental flaws that let it be cracked in minutes with free tools. WPA and WPA2 networks that use a shared password can be attacked by capturing the handshake that happens when a device connects, then trying to crack it offline with a dictionary attack. KRACK attacks exploit a flaw in WPA2's four-way handshake (a flaw in the standard itself, so nearly every WPA2 device needed a patch), and downgrade attacks trick devices into using weaker encryption that's easier to break.
Example: an attacker captures a WPA2 handshake by watching for (or forcing) a device to reconnect, then takes it offline where there's no time pressure and tries billions of password combinations using powerful computing resources. If the network's password is something weak like
Summer2023!, it gets cracked within hours, giving the attacker legitimate-looking access to the network, from which they can decrypt traffic, run man-in-the-middle attacks, or access internal resources.Assessing Network Security Risks
Network vulnerabilities threaten all three parts of the CIA triad: confidentiality risks include intercepted data, eavesdropping, and stolen credentials; integrity risks include altered data in transit or injected malicious content; and availability risks include DoS and DDoS attacks or crashes from malicious traffic.
Automated Vulnerability Scanning
Organizations use automated scanners to find weaknesses across networks, devices, and applications. Active scanning sends test packets and analyzes the responses, passive scanning just watches traffic without direct interaction, and configuration analysis checks settings against security baselines. Common tools include Nessus, OpenVAS, Qualys, and Nmap for mapping and service detection. Scan reports typically list what vulnerabilities were found, how severe they are, which systems are affected, how they could be exploited, and how to fix them.
For example, a scan might flag a critical SQL injection vulnerability in a web app with a severity near 10 out of 10, noting it could lead to full database compromise, and recommend an update or a web application firewall. It might also flag a critical remote code execution flaw in a network router allowing full device compromise, recommending an immediate patch and restricted management access.
Exploitation Difficulty and Likelihood
How likely an exploit is depends on technical complexity, what level of access is required (external internet access is harder than requiring LAN access), and whether easy-to-use exploit tools already exist. A vulnerability with a known, actively-exploited, publicly available exploit is high likelihood. Something like MAC flooding that needs physical or wireless access but has readily available tools is medium likelihood. An advanced cryptographic attack needing specialized knowledge, heavy computing resources, and physical proximity is low likelihood.
High-Risk Network Vulnerabilities
A high risk is a vulnerability that lets an adversary easily cause a significant impact, like capturing network traffic, spoofing a legitimate device on the network, or launching a DoS attack.
Example: an organization runs a single, unsegmented internal network accessible over weak WEP-encrypted Wi-Fi, with a critical server holding trade secrets and customer data sitting right on that same network. WEP can be cracked in minutes with free tools, giving full LAN access straight to that unprotected server. Since exploitation is easy, the target is valuable, and attack methods are well known, likelihood is high, and impact is severe, potentially over $5,000,000 between stolen IP, breach costs, fines, and reputational damage. That combination of easy exploitation, no segmentation, and high-value assets makes this a high risk needing immediate fixing.
Moderate-Risk Network Vulnerabilities
A moderate risk is a vulnerability that could give adversaries information about the systems or devices on a network. It doesn't hand over access or knock anything offline by itself, but it helps an adversary plan the next attack.
Example: a firewall isn't configured to block external ICMP traffic, letting attackers ping internal addresses and trace routes to map out network structure. It's trivial to exploit and commonly done, so likelihood is high, but the impact is moderate since it's just information disclosure rather than direct access or disruption, though it does help set up future, more targeted attacks. That makes it a moderate risk worth addressing within 3 to 6 months.
Low-Risk Network Vulnerabilities
A low risk is a vulnerability that would be difficult to exploit and would likely have only a small negative impact on the organization.
Example: wireless access points broadcast beacon frames revealing the network name and encryption type, which is just standard WiFi behavior. Since most organizations use fairly standard setups, this doesn't give attackers much, and it doesn't enable direct access or data theft, so it rates as low risk and organizations can generally just accept it, especially if strong WPA3 encryption with a solid password is already in place. That said, this becomes more of a concern if it reveals weak encryption like WEP, or combines with other issues like a weak password.
Documenting Network Risk
A thorough network risk assessment documents the vulnerabilities found, who might exploit them, how likely and how damaging an exploit would be, and what should be done about it, giving the organization a clear, prioritized path for fixing things and justifying security spending.
Here's what that documentation could look like for the three examples above:
Vulnerability | What an adversary could do | Likelihood | Impact | Risk |
One unsegmented internal network, reachable over WEP-encrypted Wi-Fi, with the trade-secret server on it | Crack the Wi-Fi key, join the LAN, capture traffic, spoof devices, and reach the server | High (free tools, well-known methods) | Severe (stolen trade secrets and customer data) | High: fix now |
External firewall doesn't block ICMP traffic | Ping internal addresses and trace routes to map the network | High (trivial and common) | Moderate (information only) | Moderate: fix within 3 to 6 months |
WAPs broadcast beacon frames with the SSID and encryption protocols | Learn the network's name and encryption type | Low (that information alone doesn't get anyone in) | Low (no access or data theft) | Low: accept it, as long as encryption is strong |