Network-Security

ICMP Smurf

ArubaOS 8.13.2.0 Smurf Amplification & ICMP Reflection: Pre-Auth uRPF Missing + Broadcast Reply | HPE Bugcrowd N/A

ArubaOS 8.13.2.0 does not validate ICMP Echo Request source IPs against MAC/IP bindings or apply uRPF — attacker MAC with victim IP is accepted and replied to (CWE-290). Broadcast source IP (192.168.56.255) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment (CWE-406). Two-machine evidence: Parrot OS attacker sends spoofed request, Windows victim receives unsolicited Echo Reply id=0xc101 confirmed in independent pcap. No ICMP request was sent from the victim. RFC 1122 §3.2.2.6 violation. Bugcrowd closed as expected behavior. No fix issued.

DNS Networking

DNS State Exhaustion: Water Torture, NXNS Amplification, TsuNAME & DoT/DoH Socket Starvation

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.

TCP Networking

TCP State Exhaustion: TIME_WAIT Flood, Sockstress Persist Timer Abuse & Conntrack DoS | Linux Kernel

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.

Assembly RFC-1071

RFC 1071 One's Complement Checksum in x64 Assembly: ICMP Carry Folding, Odd-Byte Handling & Packet Verification

ICMP packets with incorrect checksums are silently dropped by the kernel before reaching the destination. RFC 1071 mandates 16-bit one’s complement sum: accumulate packet words in eax, handle odd trailing byte separately, fold the carry bits (shr r11d,16 → and eax,0xFFFF → add ax,r11w → adc ax,0), invert with not ax. The receiver repeats the same sum — result must be 0xFFFF for a valid packet. Full x64 Assembly implementation with register layout, loop termination, and ICMP header integration.