💣 04-04: RST Injection¶

📌 Definition¶

RST injection (also called a TCP reset attack) is an attack that forcibly terminates someone else's TCP connection by forging a single packet with the RST (reset) flag set, using a sequence number the target will accept as valid for that connection.

👉 Unlike session hijacking, the attacker isn't trying to take over the connection or inject useful data into it — the entire goal is simply to kill it.

🧠 How TCP RST Normally Works¶

The RST flag is a completely legitimate part of TCP — it's how one side abruptly tells the other "this connection is invalid, tear it down now," without going through the normal graceful close (FIN) sequence. Legitimate reasons a RST gets sent include:

A host receives a packet for a port/connection it doesn't recognize
An application crashes and the OS cleans up its sockets
A firewall or NAT device rejects unexpected traffic (as seen in the SYN flooding lab notes — NAT devices sometimes generate RSTs for connections they have no record of)

The problem: like every other TCP field, nothing cryptographically proves who is allowed to send a RST for a given connection. If an attacker can produce a RST packet with the right IPs, ports, and an acceptable sequence number, the receiving TCP stack will honor it exactly as if it came from the real peer.

🧩 How the Attack Works¶

Step 1: Identify the target connection¶

The attacker needs to know (usually by sniffing, e.g. via a prior ARP spoofing position — see 03-04: ARP Spoofing Attacks):

Source and destination IP addresses
Source and destination ports
A sequence number the target will currently accept

Step 2: Forge the RST packet¶

from scapy.all import IP, TCP, send

ip = IP(src="192.168.1.20", dst="192.168.1.10")   # spoofed as one side of the connection
tcp = TCP(
    sport=23,          # Telnet server's port
    dport=52344,       # the client's port for this session
    flags="R",         # RST flag set
    seq=889001122      # a sequence number the receiver will accept
)

pkt = ip / tcp
send(pkt, verbose=0)

Step 3: The victim's TCP stack tears down the connection¶

The receiving side sees a RST that matches an active connection's IPs, ports, and an acceptable sequence number, and immediately closes it — no confirmation, no warning to the application beyond a "connection reset by peer" error.

💡 Sequence number tolerance: unlike a data-injection packet (which typically needs to match sequence numbers exactly), most TCP implementations accept a RST if its sequence number falls anywhere within the current receive window — not just the one exact next-expected value. This makes blind RST injection meaningfully easier to pull off than blind session hijacking, since the attacker has a range of acceptable values to guess rather than a single number.

🎯 Why This Is Used for Connection-Reset / Censorship Attacks¶

RST injection has a notorious real-world use case beyond LAN pranks or lab exercises: network-level censorship and content blocking.

Some national/organizational firewalls perform deep packet inspection on traffic passing through their infrastructure (which naturally puts them in an on-path position — no ARP spoofing needed, since they're already in the traffic path).
When they detect a connection to a blocked keyword, domain, or service, rather than silently dropping packets, they inject forged RST packets to both endpoints, making it look to each side like the other side simply hung up or that the network is malfunctioning.
This is attractive to censors because it's cheap to implement, doesn't require holding any per-connection state beyond triggering on a match, and can be layered onto existing network infrastructure without disrupting unrelated traffic.

👉 This is functionally identical to the lab-style RST attack above — the only difference is scale and position: a censorship apparatus is already on-path for enormous volumes of traffic, rather than a single attacker having to ARP-spoof their way onto a LAN.

🖼️ Realistic Scenario¶

Two coworkers, Alice and Bob, have an active Telnet session for a legacy internal tool. A disgruntled third employee, Carol, has ARP-spoofed her way into a MITM position on the office LAN and is sniffing traffic out of curiosity. She notices the Telnet session and, rather than hijacking it, decides to simply be disruptive: she crafts a single forged RST packet using the sniffed IPs, ports, and an in-window sequence number, and sends it.

Instantly, both Alice's and Bob's Telnet clients report the connection was reset. They have no way to tell whether it was a network glitch, a server crash, or something malicious — the protocol gives no such indication. Alice reconnects and re-authenticates, unaware anything unusual happened.

🔗 Relationship to Session Hijacking¶

RST injection and session hijacking (04-03: TCP Session Hijacking) share the exact same prerequisite knowledge (IPs, ports, an acceptable sequence number) and the exact same delivery mechanism (a single forged packet). They diverge only in the flag set and the attacker's goal:

	RST Injection	Session Hijacking
Flag(s) set	`RST`	`ACK` (carries injected data)
Sequence number precision needed	Anywhere in receive window	Exact next-expected value
Goal	Terminate the connection	Take over / inject commands into the connection
Victim's experience	Connection drops unexpectedly	Connection appears to behave normally (until desync)

🛡️ Defenses (Preview)¶

Full mitigation coverage comes in the next lesson, but the short version: ISN randomization and TCP sequence number unpredictability make blind RST injection much harder, while encryption (TLS/SSH) doesn't stop a RST from tearing down a connection, but does prevent an attacker from making sense of or meaningfully manipulating anything beyond that — since the attacker still can't read or inject valid encrypted application data. Some protocols and hardened TCP stacks also add extra validation (e.g., requiring the RST's sequence number to match exactly, not just fall in-window) specifically to raise the difficulty of this attack.

📌 Key Takeaways¶

RST injection forges a TCP packet with the RST flag to forcibly and abruptly terminate someone else's connection.
It relies on the same lack of cryptographic authentication in TCP that enables session hijacking — matching IPs, ports, and an acceptable sequence number is enough.
Most TCP stacks accept a RST if its sequence number falls anywhere within the current receive window, making blind RST injection somewhat easier than blind session hijacking.
Real-world censorship systems use RST injection at scale from an on-path position (e.g., national firewalls performing deep packet inspection) to disrupt connections to blocked content.
RST injection and session hijacking are mechanically identical in setup, differing only in the forged flag and the attacker's intent (kill vs. take over).
Encryption doesn't stop a connection from being reset, but limits what else an attacker can do even with knowledge of sequence numbers.
Comprehensive defenses (SYN cookies, ISN randomization, TCP timestamps) are covered next in 04-05: Mitigations (SYN Cookies & Randomization).