Networking Exploits Project

This project includes the implementation of various networking exploits and security mechanisms, focusing on DNS Server, DNS Tunneling, ARP Spoofing, and TCP Hijacking. The goal is to understand and demonstrate key networking vulnerabilities and techniques to mitigate them.

Prerequisites

• Python 3.x
• Docker
• Docker Compose

Setup

1. Clone the repository:

   git clone https://github.com/your-username/networking-exploits.git
   cd networking-exploits

2. Build the Docker containers:

   docker-compose build --no-cache

3. Start the Docker containers:

   docker-compose up -d

DNS Server

This minimal DNS server resolves domain names to IP addresses.

1. Start the DNS server:

   sudo systemctl disable systemd-resolved
   sudo systemctl stop systemd-resolved
   sudo python3 src/dns_server.py

2. Test the DNS server:

   dig @<server_ip> <domain>

DNS Tunneling

This implementation demonstrates a DNS tunneling attack by sending data through DNS queries and responses.

1. Open the necessary ports and start the DNS tunneling server:

   sudo iptables -I INPUT 6 -p udp -m udp --dport 53 -j ACCEPT
   sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 8080 -j ACCEPT
   sudo netfilter-persistent save
   sudo systemctl disable systemd-resolved
   sudo systemctl stop systemd-resolved
   cd src/dns_tunneling
   sudo python3 server.py <file_to_transfer>

2. On the client side, start the DNS tunneling client:

   sudo python3 src/dns_tunneling/client.py <file_to_transfer>

3. Verify the integrity of the transferred file using md5 checksum:

   md5sum <file_to_transfer>

ARP Spoofing

The ARP spoofing attack intercepts communication between the server and router.

1. Modify the docker-compose.yml file to replace /scripts/tcp_hijacking.py with /scripts/arp_spoofing.py.

2. Rebuild and start the containers:

   docker-compose down
   docker-compose build --no-cache
   docker-compose up -d

3. Execute the ARP spoofing script:

   docker-compose exec middle bash
   python3 scripts/arp_spoofing.py

4. Verify the attack by running a command on the server:

   docker-compose exec server bash
   wget http://old.fmi.unibuc.ro

TCP Hijacking

This attack intercepts and modifies TCP communication between the client and server.

1. Ensure the ARP spoofing is running as described in the previous section.

2. Run the TCP client and server scripts:

   docker-compose exec server bash
   python3 scripts/tcp_server.py
   
   docker-compose exec client bash
   python3 scripts/tcp_client.py

3. Modify and intercept messages by running the TCP hijacking script:

   docker-compose exec middle bash
   python3 scripts/tcp_hijacking.py

Docker Commands Summary

• Build Docker containers:

  docker-compose build --no-cache

• Start Docker containers:

  docker-compose up -d

• Stop and remove Docker containers:

  docker-compose down

Conclusion

This project demonstrates various network exploits and their mitigation techniques. Each script provides insights into how vulnerabilities can be exploited and offers practical experience in enhancing network security.