[Attacks and Exploits] A penetration tester is authorized to perform a DoS attack against a host on a network. Given the following input: ip =…

The provided script crafts and sends TCP packets. The critical line is tcp = TCP(sport=RandShort(), dport=80, flags="S"). This sets the TCP flag to "S" for SYN (Synchronize). The script then sends these SYN packets in a continuous loop (loop=1) to the target IP address (192.168.50.2). This technique, which involves sending a high volume of SYN requests without completing the three-way handshake, is the exact mechanism of a SYN flood attack. The objective is to exhaust the target server's resources by filling its connection state table with half-open connections, thereby denying service to legitimate users.

A. MDK4: This is a tool specifically designed for attacking IEEE 802.11 (Wi-Fi) networks, not for conducting TCP-based network layer attacks.

B. Smurf attack: This is an amplification attack that uses ICMP echo requests sent to a network's broadcast address, not TCP SYN packets sent to a single host.

C. FragAttack: This refers to a collection of vulnerabilities in the Wi-Fi standard related to frame fragmentation and aggregation, which is unrelated to a TCP SYN flood.

1. Internet Engineering Task Force (IETF). (2007). RFC 4987: TCP SYN Flooding Attacks and Common Mitigations. Section 2

"The TCP SYN Flooding Attack". This document describes the attack as sending a high rate of TCP SYN packets to a victim server without any intention of completing the 3-way handshake

which is precisely what the script performs.

2. National Institute of Standards and Technology (NIST). (2012). SP 800-61 Rev. 2: Computer Security Incident Handling Guide. Section 3.3.3

"Denial of Service". This publication explicitly lists SYN flooding as a common DoS attack vector where an attacker sends a large number of TCP SYN packets to a host.

3. Saltzer

J. H.

& Kaashoek

M. F. (2014). 6.858 Computer Systems Security

Fall 2014 Course Notes. Massachusetts Institute of Technology: MIT OpenCourseWare. Lecture 15

"Network Security

" page 6. The lecture notes describe a SYN flood as an attack where the attacker "sends many SYN packets to server

filling up its queue of pending connections."