The answersDownload the PDF
Worksheet

F11.4 Network attacks

Cyber security · GCSE · OCR J277 1.4.1, Edexcel 1CP2 4.2.1 · about 20 min

BugBotLab
NameClassDate

What this lesson is about

Brute force, denial of service, data interception and SQL injection, and detecting a flood.

Questions 6 marks in all

  1. [1 mark]What is a brute force attack?

    1. ATrying every possible password until one works
    2. BFlooding a server with requests
    3. CReading data as it travels
    4. DTricking a database

  2. [1 mark]What does a denial of service attack do?

    1. AFloods a system so it cannot serve real users
    2. BSteals passwords
    3. CEncrypts files for ransom
    4. DReads private messages

  3. [1 mark]How is intercepted data made useless to an attacker?

    1. ABy encrypting it
    2. BBy compressing it
    3. CBy deleting it
    4. DBy sending it faster

  4. [1 mark]What is a botnet?

    1. AMany hijacked computers used together in an attack
    2. BA kind of firewall
    3. CA password manager
    4. DA backup system

  5. [1 mark]How is SQL injection prevented?

    1. AValidating input and keeping it separate from the query
    2. BUsing a faster database
    3. CEncrypting the web page
    4. DAdding more servers

  6. [1 mark]How many possible codes does a 4-digit PIN have?

The task: flood detector

Count how many requests come from each address in requests. Print <address>: <n> for each, sorted from the most requests to the fewest. Any address with 5 or more requests is an attack: print BLOCK on its line, and at the end print blocked: <addresses>, the blocked addresses joined by , .

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

requests = [
    "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5", "10.0.0.2",
    "10.0.0.5", "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5",
]

Plan your program here, then type it in and press Run.

QR code
Do it on the robot
www.bugbotlab.com/learn/f11-4-network-attacks/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

  1. How many tries does brute force need, at most, for a 6-digit PIN?
  2. Why is a DDoS from a botnet harder to block than a DoS from one computer?
  3. Explain in one sentence how SQL injection lets someone log in without a password.