Protocols and servers

Modern FTP

FTP sends credentials and data in cleartext, making it insecure for transferring sensitive information. For this reason, FTP has been replaced in most environments by:

• SFTP (SSH File Transfer Protocol) runs over SSH on port 22 and encrypts all traffic. This is the most common replacement for FTP.
• FTPS (FTP Secure) adds TLS encryption to the FTP protocol on port 990 (implicit TLS) or uses STARTTLS on port 21.
• SCP (Secure Copy Protocol) also runs over SSH, though it is being deprecated in favour of SFTP.

FTP Servers and Clients

• vsftpd (Very Secure FTP Daemon) is one of the most common FTP servers on Linux systems.
• ProFTPD is highly configurable and modular.
• Pure-FTPd focuses on security and simplicity.
• On Windows, IIS includes FTP server capabilities.

Simple Mail Transfer Protocol (SMTP)

1. Simple Mail Transfer Protocol (SMTP) for sending email
2. Post Office Protocol version 3 (POP3) or Internet Message Access Protocol (IMAP) for receiving email

Email Delivery Components

• Mail User Agent (MUA): The email client (e.g., Thunderbird, Outlook, a webmail interface).
• Mail Submission Agent (MSA): Receives mail from the MUA, checks for errors, and forwards it.
• Mail Transfer Agent (MTA): Routes and delivers mail between servers.
• Mail Delivery Agent (MDA): Stores the email in the recipient's mailbox for retrieval.

flowchart LR
    MUA1["MUA (sender)"] -->|"1 Submission"| MSA["MSA"]
    MSA -->|"3 Relay"| MTA2["MTA"]
    MTA2 -->|"4 Delivery"| MDA["MDA"]
    MDA -->|"5 Retrieval"| MUA2["MUA (recipient)"]

    MSA -.->|"2 Queue/spool"| MSA
    MDA -.->|"Store"| MDA

    subgraph Internet [" "]
        MTA2
    end

    classDef server fill:#dce6f5,stroke:#5a7bb0,stroke-width:1px,color:#2a4a7a;
    classDef client fill:#eef2f7,stroke:#8494a8,stroke-width:1px,color:#333;
    class MSA,MTA2,MDA server;
    class MUA1,MUA2 client;

Attacks

Sniffing Attack

A sniffing attack refers to using a network packet capture tool to collect information about the target. When a protocol communicates in cleartext, the data exchanged can be captured by a third party to analyse.

Where Sniffing Attacks Are Still Relevant

• Internal corporate networks where traffic between systems may not be encrypted
• Legacy systems that still use cleartext protocols (older mail servers, embedded devices, industrial control systems)
• Misconfigured services where TLS is available but not enforced
• IoT devices that often use unencrypted protocols for communication
• Wireless networks where attackers within range can capture traffic
• After a successful MITM attack that downgrades or strips encryption

Packet Capture Tools

• Tcpdump
• Wireshark
• Tshark

Practical Example: Capturing POP3 Credentials

sudo tcpdump port 110 -A

The port 110 filter limits captured packets to those exchanged with the POP3 server (POP3 uses port 110 by default). The -A flag displays the contents of captured packets in ASCII format, making cleartext credentials readable in the output.

Useful Tcpdump Filters

# Capture traffic on a specific port
sudo tcpdump port 110 -A

# Capture traffic to/from a specific host
sudo tcpdump host 10.20.30.148 -A

# Capture HTTP traffic (may include credentials in POST requests)
sudo tcpdump port 80 -A

# Capture FTP traffic (credentials sent in cleartext)
sudo tcpdump port 21 -A

# Write captured packets to a file for later analysis
sudo tcpdump -w capture.pcap

# Read and analyse a capture file
tcpdump -r capture.pcap -A

How MITM Attacks Work

• ARP Spoofing:
• DNS Spoofing: involves providing false DNS responses to redirect victims to attacker-controlled servers. This can happen through compromised DNS servers, DNS cache poisoning, or by responding to DNS queries faster than the legitimate server.
• Rogue Access Points: are fake wireless access points set up by attackers. When victims connect to these networks (often named to look like legitimate networks such as Airport_WiFi_Free), all their traffic flows through the attacker's system.
• BGP Hijacking: operates at the internet routing level, where attackers announce false BGP routes to redirect traffic through their infrastructure. This is a more sophisticated attack, typically targeting specific organisations or regions.

Tools for MITM Attacks

• bettercap: The Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking, CAN-bus and IPv4 and IPv6 networks reconnaissance and MITM attacks.
• mitmproxy is an interactive HTTPS proxy that allows inspection and modification of traffic. It is particularly useful for analysing and manipulating HTTP/HTTPS communications.

MITM Against Encrypted Traffic

• SSL Stripping downgrades HTTPS connections to HTTP.
• Fake Certificates involve the attacker presenting their own certificate and establishing separate encrypted connections with both parties.
• Compromised or Rogue CAs

Modern Defences Against MITM

• HTTPS Everywhere
• HSTS (HTTP Strict Transport Security): tells browsers to only connect via HTTPS for a specified period. Once a browser has seen an HSTS header for a domain, it will refuse to connect over HTTP, preventing SSL stripping attacks. Many major sites are also on the HSTS preload list, meaning browsers ship with knowledge that these sites should only be accessed via HTTPS.
• Certificate Transparency (CT)
• Certificate Pinning allows applications to specify exactly which certificates or public keys are valid for their connections.
• DANE (DNS-based Authentication of Named Entities): uses DNSSEC to publish certificate information in DNS records, providing an alternative trust path that does not rely solely on the CA system.

flowchart TB
    L7["<b>7 — Application Layer</b><br/>HTTP, HTTPS, SMTP, POP3, IMAP, etc."]
    L6["<b>6 — Presentation Layer</b><br/>SSL, TLS"]
    L5["<b>5 — Session Layer</b>"]
    L4["<b>4 — Transport Layer</b><br/>TCP, UDP"]
    L3["<b>3 — Network Layer</b><br/>IPv4, IPv6"]
    L2["<b>2 — Data Link Layer</b>"]
    L1["<b>1 — Physical Layer</b>"]

    L7 --- L6 --- L5 --- L4 --- L3 --- L2 --- L1

    classDef app fill:#ffffff,stroke:#e03c3c,stroke-width:2px,color:#5a6ecf;
    classDef net fill:#a01c2b,stroke:#a01c2b,stroke-width:2px,color:#ffffff;
    classDef link fill:#5c1420,stroke:#5c1420,stroke-width:2px,color:#ffffff;
    classDef phys fill:#3a0d15,stroke:#3a0d15,stroke-width:2px,color:#ffffff;

    class L7,L6,L5,L4 app;
    class L3 net;
    class L2 link;
    class L1 phys;

Testing TLS Configurations

As a security professional, you may need to assess TLS configurations. Useful tools include:

• testssl.sh: A command-line tool that checks a server's TLS configuration for supported protocols, cipher suites, and common vulnerabilities. It is the best choice for detailed assessments, especially against internal systems that are not publicly accessible.
• sslyze: A Python tool for analysing SSL/TLS configurations, useful for automation and integration into CI/CD pipelines.
• SSL Labs (ssllabs.com): A web-based service that provides detailed analysis of public-facing HTTPS servers. It is the quickest option for a one-off assessment of a public website. nmap ssl-enum-ciphers: An Nmap script that enumerates supported cipher suites as part of a broader port scan.

Password Attacks

# Attack FTP with username mark
hydra -l mark -P /usr/share/wordlists/rockyou.txt 10.112.134.30 ftp

# Alternative syntax (equivalent to above)
hydra -l mark -P /usr/share/wordlists/rockyou.txt ftp://10.112.134.30

# Attack SSH with username frank
hydra -l frank -P /usr/share/wordlists/rockyou.txt 10.112.134.30 ssh

# Attack IMAP with username lazie
hydra -l lazie -P /usr/share/wordlists/rockyou.txt 10.112.134.30 imap

# Attack with a list of usernames (credential stuffing style)
hydra -L users.txt -P passwords.txt 10.112.134.30 ssh

Password Attack Tools

• Medusa is similar to Hydra but with a modular design. Some find it more stable for certain protocols.
• Ncrack is developed by the Nmap project and designed for high-speed parallel authentication testing.
• CrackMapExec (CME) / NetExec specialises in Windows/Active Directory environments and can spray passwords across SMB, WinRM, LDAP, and other protocols.
• Burp Suite Intruder is useful for attacking web-based login forms where Hydra's HTTP modules may not work correctly.
• Hashcat and John the Ripper are used for cracking password hashes offline rather than attacking live services. If you obtain password hashes (from a database breach, for example), these tools can recover the plaintext passwords much faster than attacking a live service

Mitigating Password Attacks

Mitigation against password attacks depends on the target system. Modern defences include:

• Password Policies enforce minimum complexity constraints. Modern guidance such as NIST SP 800-63B (a U.S. government standard for digital identity guidelines) recommends focusing on password length over complexity rules, blocking known compromised passwords, and not requiring regular password changes unless there is evidence of compromise.

• Account Lockout temporarily or permanently locks an account after a certain number of failed attempts. This is effective against brute force but can be bypassed by password spraying or abused for denial of service.

• Throttling and Rate Limiting delay responses to login attempts. A few seconds of delay is tolerable for legitimate users but severely hinders automated tools. More sophisticated implementations use exponential backoff.

• CAPTCHA requires solving a challenge difficult for machines. Modern CAPTCHAs use behavioural analysis and risk scoring rather than just image recognition.

• Multi-Factor Authentication (MFA) requires additional verification beyond the password, such as a code from an authenticator app, SMS (though SMS is less secure), or a hardware security key. MFA is one of the most effective defences against password attacks.

• Passwordless Authentication eliminates passwords entirely using methods like:

• Passkeys (FIDO2/WebAuthn) use cryptographic keys stored on devices, replacing passwords with biometric or PIN verification.

• Magic links sent via email.

• Hardware security keys like YubiKeys.

• Breached Password Detection checks passwords against known breach databases during registration and login. Services like "Have I Been Pwned" provide APIs for this purpose.

• Behavioural Analysis detects anomalies such as login attempts from unusual locations, impossible travel scenarios, or patterns consistent with automated attacks.

• IP-based Controls including geofencing, blocking known malicious IPs, and requiring additional verification for new devices or locations.