Liso — Attack methods
The newcereal attack vectors Cereal2 recognizes, with what each one does and how often it has been observed.
- Large UDP datagramsVector 1
Sends generated UDP payloads, with a default length of 1400 bytes.
- Configurable UDP payloadVector 2
Sends random or repeated hex-decoded payload bytes using fixed or ranged datagram lengths.
- Small randomized UDPVector 3
Sends randomized UDP payloads of 1–22 bytes.
- Raw TCP SYNVector 4
Sends crafted IPv4/TCP packets with SYN set by default; flags and packet fields are configurable.
- Raw TCP ACKVector 5
Sends crafted IPv4/TCP packets with ACK set by default; flags and packet fields are configurable.
- Raw TCP FIN/PSH/ACKVector 6
Sends crafted IPv4/TCP packets with FIN, PSH and ACK set by default; flags are configurable.
- TCP connection and data poolVector 7
Opens 64–128 nonblocking TCP connections, writes random bytes repeatedly and replaces closed connections.
- TCP session holdingVector 8
Holds a configurable TCP connection pool and sends one-byte newlines periodically, every 15 seconds by default.
- Raw TCP payload with SYN/ACK preludeVector 9
Sends crafted SYN and ACK packets using locally generated sequence values, then PSH/ACK payload packets without waiting for a handshake response.
- TCP handshake then raw packetsVector 10
Starts a stream connection, obtains TCP state from received packets and then sends crafted TCP traffic with optional payload.
- GRE carrying UDPVector 11
Constructs IPv4/GRE packets containing another IPv4 packet and UDP payload, with configurable inner addresses and GRE fields.
Last 30 days