DAY 11 & 12 of SOC Training

Introduction

Day 11 of SOC Training was a short recap of all the concepts covered up till now. It was a short overview from the point of interview and revision to identify our current level. Day 12 covers the role of SOC L1 when it comes to MITM and DDOS attacks.

Practice interview questions which were discussed in Defronix Academy is listed in the Learning Resources as well as some additional materials by me are also listed for better understanding.

1. Man-in-the-Middle (MITM) Attacks

Definition:

MITM attack occurs when an attacker positions themselves between two communicating parties (typically a user and a server) to intercept, monitor, or manipulate the communication without either party’s knowledge.

The attacker essentially becomes an invisible intermediary who can eavesdrop on conversations, steal sensitive data, or inject malicious content.

MITM Attack Techniques

1. ARP Spoofing (ARP Poisoning):

ARP spoofing is a technique where an attacker sends falsified ARP messages to a local network, linking their MAC address with the IP address of a legitimate network device (usually the gateway/router).

This causes traffic intended for the gateway to be sent to the attacker instead.

How It Works:

• Attacker connects to local network (same subnet as victim)

• Attacker sends fake ARP replies to victim’s computer

• Fake ARP reply claims attacker’s MAC address is the gateway’s IP

• Victim updates its ARP cache with incorrect information

• All victim’s traffic goes through attacker instead of gateway

• Attacker forwards traffic to real gateway (to avoid suspicion)

2. DNS Spoofing (DNS Cache Poisoning):

DNS spoofing redirects a user to a fraudulent website by providing a fake IP address for a legitimate domain name.

The attacker either compromises DNS responses or poisons DNS caches to serve malicious IP addresses.

How It Works:

• User attempts to visit legitimate website (e.g., bank.com)

• Computer sends DNS query to resolve domain to IP address

• Attacker intercepts DNS query (via MITM position)

• Attacker responds with malicious IP address before legitimate DNS server

• User’s browser connects to attacker’s server instead of real bank

• Attacker presents fake login page and steals credentials

3. SSL Stripping:

SSL stripping is a downgrade attack where an attacker intercepts the connection between client and server, downgrades secure HTTPS connections to unencrypted HTTP, allowing the attacker to read all traffic in plaintext.

How It Works

Why It Works:

• Many sites initially load via HTTP then redirect to HTTPS

• Users often ignore HTTP vs HTTPS indicators

• Not all sites implement HSTS (HTTP Strict Transport Security)

Detection Indicators:

• Sites that should be HTTPS showing as HTTP

• Browser not displaying padlock icon on secure sites

• Certificate warnings from browser

• HTTP traffic on ports typically used for HTTPS

Common Tools:

• sslstrip, Bettercap, mitmproxy

4. Evil Twin Attack:

An Evil Twin attack involves creating a fake Wi-Fi access point with the same SSID (network name) as a legitimate network.

Users unknowingly connect to the malicious access point, allowing the attacker to intercept all their network traffic.

Common Scenarios:

• Coffee shops and airports (users expect open networks)

• Corporate offices (fake ‘Guest WiFi’)

• Hotels and conferences

• Public events

MITM Prevention Strategies

For Users:

• Use VPN: Encrypts all traffic even on untrusted networks

• Always Use HTTPS: Check for padlock icon and HTTPS://

• Monitor Certificate Warnings: Never ignore SSL/TLS errors

• Avoid Public WiFi: Use mobile hotspot when possible

• Verify Network Names: Confirm legitimate SSID with staff

For Organizations:

• Implement 802.1X Authentication: Secure network access control

• Deploy HSTS: Force HTTPS connections

• Use Certificate Pinning: Prevent certificate substitution

• Monitor ARP Tables: Detect ARP spoofing

• Implement DNSSEC: Secure DNS responses

• Wireless Intrusion Detection: Detect rogue access points

• Network Segmentation: Limit impact of compromised network

“Remember Security is illusion but implementing security measures just make hard for attacker to break into your system so, at least there’s a chance to be save.”

2. Distributed Denial of Service (DDoS) Attacks

Definition:

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of Internet traffic from multiple compromised systems.

These systems, called bots or zombies, form a botnet controlled by the attacker.

Types of DDoS Attacks

1. Volumetric Attacks:

Volumetric attacks aim to consume all available bandwidth between the target and the Internet. These attacks flood the network with such massive amounts of traffic that legitimate requests cannot get through.

UDP Flood:

Sends large numbers of UDP packets to random ports on target system. Victim attempts to process packets and send ICMP ‘Destination Unreachable’ responses, exhausting resources.

ICMP Flood (Ping Flood):

Overwhelms target with ICMP Echo Request (ping) packets. Victim expends resources responding with ICMP Echo Reply packets.

Amplification Attacks:

Exploits publicly accessible servers to amplify attack traffic. Attacker sends small request with spoofed source IP (victim’s IP) to amplification server, which sends much larger response to victim.

Common amplification vectors:

• DNS Amplification: 28–54x amplification factor

• NTP Amplification: Up to 556x amplification

• Memcached Amplification: Up to 51,000x amplification

• SSDP Amplification: 30x amplification

2. Protocol Attacks:

Protocol attacks exploit weaknesses in Layer 3 and Layer 4 network protocols. They consume server resources or intermediate network equipment (firewalls, load balancers).

SYN Flood:

Exploits TCP’s three-way handshake. Attacker sends massive number of SYN packets with spoofed source IPs. Server allocates resources for each connection and sends SYN-ACK, but never receives final ACK. Connection table fills up, preventing legitimate connections.

Ping of Death:

Sends malformed or oversized ICMP packets that exceed maximum packet size. When reassembled, causes buffer overflow and system crash. Less common on modern systems due to patches.

Smurf Attack:

Sends ICMP Echo Request to network broadcast address with spoofed source IP (victim’s IP). All hosts on network respond to victim, amplifying attack.

3. Application Layer Attacks (Layer 7):

Application layer attacks target the application itself, consuming server resources by making seemingly legitimate requests. These are the most sophisticated and difficult to detect because traffic appears normal.

HTTP Flood:

Sends massive number of HTTP GET or POST requests to web server. Requests appear legitimate but overwhelm server’s ability to respond.

Slowloris:

Keeps many connections to target web server open and holds them as long as possible. Sends partial HTTP requests that never complete, exhausting server’s connection pool.

DNS Query Flood:

Overwhelms DNS servers with lookup requests, preventing legitimate DNS resolution.

DDoS Mitigation Strategies

1. Rate Limiting:

Limit the number of requests a server accepts from a single source within a given time period.

• Effective against application layer attacks

• Can be implemented at firewall, load balancer, or application level

• Must balance protection with legitimate user needs

2. Web Application Firewall (WAF):

Filters and monitors HTTP traffic between web application and Internet. Can detect and block malicious requests.

• Protects against Layer 7 attacks

• Can identify attack patterns and signatures

• Examples: ModSecurity, Cloudflare WAF, AWS WAF

3. Content Delivery Network (CDN):

Distributes content across multiple servers worldwide. Absorbs attack traffic across distributed infrastructure.

• Provides massive bandwidth capacity

• Distributes load geographically

• Examples: Cloudflare, Akamai, AWS CloudFront

4. DDoS Mitigation Services:

Specialized services that detect and mitigate DDoS attacks. Route traffic through scrubbing centers that filter malicious traffic.

• Always-on or on-demand protection

• Can handle massive attacks (terabits per second)

• Examples: Cloudflare Magic Transit, Akamai Prolexic, AWS Shield

5. Infrastructure Hardening:

• Increase bandwidth capacity

• Deploy redundant servers and load balancers

• Configure SYN cookies to prevent SYN flood

• Disable unnecessary services and ports

• Implement connection limits

SOC Detection and Response

Investigation Steps:

• Identify affected services and systems

• Determine attack type (volumetric, protocol, application layer)

• Analyze traffic patterns and source IPs

• Check for botnet signatures

• Assess impact on business operations

• Coordinate with network team and ISP

Conclusion

Network attacks — particularly MITM and DDoS — represent critical threats that every SOC analyst must understand. These attacks target the fundamental communication infrastructure that organizations depend on, and their impact can range from stolen credentials to complete service disruption costing millions in lost revenue.

Key Takeaways:

• Network Fundamentals Are Essential: Understanding TCP/IP, protocols, and packet structure is foundational for analyzing network attacks

• MITM Attacks Are Stealthy: ARP spoofing, DNS poisoning, and SSL stripping often go undetected without proper monitoring

• DDoS Has Multiple Forms: Volumetric, protocol, and application layer attacks require different detection and mitigation approaches

• Prevention is Layered: No single control prevents all network attacks — defense in depth is essential

• Packet Analysis Skills: Wireshark and similar tools are invaluable for investigating network incidents

By mastering these concepts, SOC analysts can detect network attacks early, conduct thorough investigations, and implement effective countermeasures to protect organizational assets and maintain service availability.

LEARNING RESOURCE :

Defronix Academy — SOC Analyst Training (YouTube) SOC Training — Class 11 SOC Training — Class 12

Basic Networking Networking CheatSheet

Interview Questions and Real World Scenario (SOC L1) Quick Practice

CyberSecurity #SOCAnalyst #InfoSec #BlueTeam #LearningJourney #ContinuousLearning