I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand auditing in depth.
I got to the part of ICMP packets redirect and had a tough time to understand why exactly should I disable it, same goes for IP forwarding.
What is the exact advantage an attacker may gain by not disabling these features?
Here are the links I read it from:
for ICMP redirects:
I'm having a hard time understanding how is it possible to alter the system routing tables:
"... bogus ICMP redirect messages to maliciously alter the system routing tables"
for IP forwarding: How can an attacker exploit this if this were to be enabled?
"...will never be able to forward packets, and therefore, never serve as a router."