When pentesting a network, call it ExampleNet, the network range sometimes exceeds 256 hosts, such as the range x.y.56.0-x.y.63.255. Does this mean that a compromised host on x.y.56.z could be used to leverage a MITM attack against a range such as x.y.62.z, considering they both share the same ethernet?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
It generally depends on network setup. Some commercial switches can separate the network out into different subnets, with special routing tables between them. That way you'll have a single physical switch connecting all the machines, but you'll still have several subnets. They may also be using technologies like ipsec to encrypt and authenticate network communications, which can make a MITM attack difficult, if not impossible. But, if it's all on the same switch, the switch isn't doing anything "clever", and they're not using a protection technology such as ipsec, then you should be able to perform a MITM attack using a single comprimised host. |
|||
|
|
