Discovering brute force and application attacks
The next step in network attack is to understand the various types of brute force attacks. A brute force attack is a trial-and-error method used to obtain information from the victim, for example, trying to find organizational servers, user directories, and to crack passwords.
Getting ready
Brute force attacks will usually not produce non-standard loadson the network, and the way they are discovered is usually by IDS systems orwhen there is a suspicion that someone is trying to hack into the network. In this recipe, we will learn how to identify typical brute force attacks.
How to do it...
When you suspect a brute force on the network, follow these steps to locate it.
- Connect Wireshark with a port-mirror to the port in the server that you suspect is under attack.
- For DNS brute force attacks, look for DNS queries that are asking for common names under your domain. For example, in the following screenshot, you can see a scan for ISP servers. We can...
