This room examined three common attacks against network protocols:
- Sniffing Attack
- MITM Attack
- Password Attack
For each of these, the focus was on both the attack mechanics and the mitigation steps. Understanding these fundamental attacks is essential because they form the basis for more sophisticated techniques encountered in advanced penetration testing.
Key Takeaways
The central theme of this room is that cleartext protocols are inherently insecure. Any protocol that transmits data without encryption is vulnerable to sniffing and MITM attacks. The solution is to use encrypted alternatives:
- Use HTTPS instead of HTTP.
- Use SSH instead of Telnet.
- Use SFTP or FTPS instead of FTP.
- Use IMAPS/POP3S/SMTPS instead of their cleartext counterparts.
Even with encryption, password-based authentication remains a weak point. Strong passwords, account lockout policies, rate limiting, and multi-factor authentication are essential defences. Where possible, passwordless authentication using passkeys or certificate-based authentication provides stronger security.
The Modern Landscape
Most internet-facing services use TLS encryption by default. However, you will still encounter cleartext protocols in:
- Legacy systems that have not been updated
- Internal corporate networks where encryption was never implemented
- IoT devices and embedded systems with limited capabilities
- Misconfigured services where TLS is available but not enforced
- Development and testing environments
As a penetration tester, identifying these weaknesses and demonstrating their impact is a valuable skill. As a defender, ensuring all services use encryption and strong authentication is a fundamental security control.
Related Learning Paths
Many other attacks can be conducted against specific servers and protocols. The following modules will help you build on what you learned here:
- Vulnerability Research: Provides more information about vulnerabilities and exploits.
- Metasploit: Trains you on how to use Metasploit to exploit target systems.
- Burp Suite: Teaches you how to use Burp Suite to intercept HTTP traffic and launch attacks related to the web.
- Network Security: Covers network security concepts, including Nmap and firewallevasion.
Protocol and Port Reference
The services covered in this room are listed in the following table, sorted by alphabetical order.
| Protocol | TCPPort | Application(s) | Data Security |
|---|---|---|---|
| FTP | 21 | File Transfer | Cleartext |
| FTPS | 990 | File Transfer | Encrypted (implicit TLS) |
| HTTP | 80 | Worldwide Web | Cleartext |
| HTTPS | 443 | Worldwide Web | Encrypted (implicit TLS) |
| IMAP | 143 | Email (MDA) | Cleartext |
| IMAPS | 993 | Email (MDA) | Encrypted (implicit TLS) |
| POP3 | 110 | Email (MDA) | Cleartext |
| POP3S | 995 | Email (MDA) | Encrypted (implicit TLS) |
| SFTP | 22 | File Transfer | Encrypted (SSH) |
| SMTP | 25 | Email (MTA) | Cleartext |
| SMTP Submission | 587 | Email (MTA, client submission) | STARTTLS* |
| SMTPS | 465 | Email (MTA) | Encrypted (implicit TLS) |
| SSH | 22 | Remote Access and File Transfer | Encrypted |
| Telnet | 23 | Remote Access | Cleartext |
*STARTTLS means the connection starts unencrypted on the standard port and is then upgraded to TLS after the client issues a STARTTLS command. This differs from implicit TLS, where encryption begins immediately upon connection. STARTTLS is common on port 587 for email submission and can also be used on ports 25, 110, and 143.
Hydra Quick Reference
Hydra remains a very efficient tool for password attacks against network services. Its main options are summarised in the following table.
| Option | Explanation |
|---|---|
-l username | Provide a single login name |
-L users.txt | Provide a file containing usernames |
-p password | Provide a single password to try |
-P wordlist.txt | Specify the password list to use |
server service | Set the server address and service to attack |
-s PORT | Use in case of non-default service port number |
-V or -vV | Show the username and password combinations being tried |
-t n | Number of parallel connections (threads) |
-w n | Wait time between connections in seconds |
-f | Stop after the first valid credential found |
-d | Display debugging output if verbose output is not helping |
Additional Tools to Explore
Beyond Hydra, consider learning these tools that complement what this room covered:
| Tool | Purpose |
|---|---|
| Wireshark / tcpdump | Network packet capture and analysis |
| Bettercap | MITM attacks, ARP spoofing, and network reconnaissance |
| mitmproxy | Interactive HTTPS proxy for inspecting and modifying traffic |
| testssl.sh | Testing TLS/SSL configuration and vulnerabilities |
| Nmap | Port scanning, service detection, and scripting |
| CrackMapExec / NetExec | Password spraying and lateral movement in Windows environments |
| Hashcat / John the Ripper | Offline password hash cracking |
| Burp Suite | Web application security testing |
Defensive Checklist
When assessing or securing systems, verify the following:
- All services use TLS 1.2 or TLS 1.3 with strong cipher suites.
- Cleartext protocols (Telnet, FTP, HTTP) are disabled or restricted to isolated networks.
- SSH uses key-based authentication with password authentication disabled.
- Strong password policies are enforced with breached password detection.
- Account lockout or rate limiting is implemented for all authentication endpoints.
- Multi-factor authentication is enabled for sensitive systems.
- Network segmentation limits the impact of sniffing attacks.
- Certificate validation is properly implemented to prevent MITM attacks.
- HSTS (HTTP Strict Transport Security) is enabled for web applications to prevent SSL stripping.
- Logging and monitoring detect authentication anomalies.
Understanding both the attack and defence perspectives makes you a more effective security professional, whether you are conducting penetration tests or building secure systems.