Lesson 5 — Intermediate

Network Attacks (DoS, MITM, Sniffing)

Network attack mein attacker target data nahi, balki uska raasta (connection) pakadta hai. Is lesson mein hum DoS/DDoS, MITM aur sniffing ke mechanism samjhenge aur har ek ke liye practical defense dekhenge — concept samajho, phir protection lagao.

⏱ 15 min• Intermediate• Malware

Network attack kya hota hai

WHAT

Network attack ka matlab hai network traffic ya devices (router, server, Wi-Fi) ko target karna — data churaane ke liye (passive) ya service down karne ke liye (active).

WHEN

Jab public Wi-Fi use ho, jab website pe traffic ja raha ho, ya jab server zyada load handle kar raha ho — wahan network attack ka risk hai.

WHERE

Wi-Fi hotspot, office LAN, internet links, router, DNS — har jagah jahan data travel karta hai wahan attack mumkin hai.

Do broad category: Passive attack — chupke se dekhna/listen karna (data abhi bhi sahi hai, par leak ho gaya), aur Active attack — traffic ko badalna, rokna ya nakli banana.

DoS aur DDoS — service down karna

DoS  (Denial of Service) : EK source se server flood
DDoS (Distributed DoS)   : HAZAARON compromised devices (botnet)
                             se ek saath flood

Mechanism (concept):
  Server ke paas limited resources hain
  (CPU, bandwidth, connections)
  Flood -> resources khatam -> genuine user ko service nahi milti

Botnet = hacked devices ka army (PC + IoT) — C2 server se command

Defense :
  Rate limiting + traffic filtering rules
  CDN / dedicated DDoS protection service
  Load balancing + over-provisioning
  IoT ka default password badlo (botnet banne se roko)
  ISP-level scrubbing (bade attacks ke liye)

DoS aur DDoS ka farak sirf ek banam hazaaron source hai. Aaj kal jo DDoS hota hai wo botnet se hai — isi liye "mere PC pe kuch nahi hua" wali baat ka matlab wo infected ho sakta hai, seedha nahi.

DoS ke symptoms: site achanak slow ya down, unexpected traffic spike, 503/timeout errors.
Botnet ka role: hacked PC aur IoT devices (router, camera) ka army jo command ka wait karte hain.
Defense ownership: ISP + CDN + rate limiting mukhya, application team ka kaam monitoring aur alerts.
Bachne ka angle: IoT ka default password badlo — tumhara router bhi kal botnet ka member ban sakta hai.

Man-In-The-Middle — beech mein attacker

MITM concept:
  Attacker do parties ke BEECH mein aa jaata hai
  Dono ko lagta hai wohi se baat ho rahi hai

  Victim <-> [ATTACKER] <-> Server

  Do phase :
    Eavesdropping : chupke se data dekhna
    Tampering    : data ko badal bhi dena

Risk zones : public Wi-Fi, unencrypted HTTP, fake base station,
             spoofed hotspot (evil twin)

Defense :
  HTTPS/TLS verify karo (padlock + valid certificate)
  Untrusted network pe VPN tunnel
  Certificate warning IGNORE mat karo
  HSTS + MFA extra layers

Yaad rakho: MITM ka matlab "hacker beech mein hai" — aur use dono taraf lagta hai normal connection hai. Isliye encryption hi asli shield hai: traffic padh hi na paaye toh beech mein baithe ka fayda nahi.

Sniffing aur Spoofing

Sniffing : network packets CAPTURE karke dekhna
  Passive sniffer : sirf sunta hai, kuch badalta nahi
  Legit tool      : Wireshark (apne network ki troubleshooting)
  Attack use      : kisi aur ke bina encryption wale traffic

Spoofing : jaati hui identity ko nakli bana dena
  ARP spoofing  : router ko galat MAC batata hai
  IP spoofing   : source address nakli
  DNS spoofing  : sahi naam ke peeche galat server

Defense :
  Encrypted protocols (HTTPS, SSH, WPA3, VPN)
  Network admin ke liye: ARP inspection, port security
  App ke liye: certificate pinning, DNSSEC

Ethics line: Sniffing ka matlab sirf tool chalana nahi — doosre ke traffic ko bina permission dekhna IT Act ke under offence hai. Apne network pe troubleshooting = legitimate, doosre ka data churaana = crime.

Exercise

Question: DDoS mein "D" kya represent karta hai? (distributed/direct)

Question: MITM ka full form kya hai? (teen words, space se)

Question: Public Wi-Fi pe safe browsing ke liye kaunsa protocol chahiye — HTTP ya HTTPS?

Common mistakes

DoS aur DDoS ko same bolna: DoS = ek source, DDoS = bahut saare sources (botnet) se. DDoS rokna zyada mushkil hai isi liye.
Sniffing ko normal monitoring samajhna: Apne network ka traffic dekhna = monitoring (legal). Doosre ka bina permission = sniffing offence. Intent aur permission farak banati hai.
VPN ko anonymity samajhna: VPN traffic encrypt karta hai par VPN provider tera traffic dekh sakta hai. Safety milti hai, chhupna guarantee nahi.

Desi example: Hotel ki free Wi-Fi

Hotel mein "Free_WiFi_Hotel" connect kiya, browser pe bank kholne ki koshish. Wahi par attacker ka evil twin tha — traffic uske paas ja raha tha. Safe rule:

Risky : free Wi-Fi pe banking/login (MITM zone)
Safe  : mobile data ya trusted VPN
Check : URL https + sahi certificate
Rule  : public Wi-Fi = sirf browsing, no sensitive kaam

Exam mapping (TCS / CUET / GATE)

TCS NQT: DoS vs DDoS difference classic question.
CUET: MITM + sniffing definitions.
Interview: "Public Wi-Fi pe kya risk hai?" — MITM ka answer chahiye.
Trap: "DDoS means single attacker" — galat, distributed botnet se hota hai.

Lesson complete?

Module 1 complete! Ab Module 2 — Defenses. Agla lesson — Cryptography Basics — jisse data apne aap safe ho jaata hai.