Tagged Questions

ARP spoofing is an attack technique which sends spoofed Address Resolution Protocol (ARP) messages to Local Area Network (LAN). The idea is to identify attacker's MAC address as the address of another network host and redirect traffic intended for another IP address to the attacker's IP address ...

learn more… | top users | synonyms

0
votes
0answers
24 views

Victim loses Internet connection during MITM attack

I tried to do MITM attack on my network. I enabled ettercap, marked my router as TARGET1 and my second computer as TARGET2. Then I enabled 'ARP Spoofing'. I do not know why - but after this operation ...
1
vote
2answers
65 views

What is the best way to run MitM attack on my wireless network?

For research purpose, I want to launch a MitM attack on computers that are connected to my wireless network. I wonder what is the best way to do so. Notice that I control the router, and do not want ...
2
votes
1answer
71 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
1
vote
1answer
71 views

Can Suricata IPS detect and prevent ARP poisoning attacks? [closed]

Does Suricata IPS have the capability to detect and prevent ARP poisoning attacks? Snort uses a preprocessor that decodes ARP packets and detects ARP attacks, but I couldn't find any such capability ...
3
votes
0answers
82 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
1
vote
2answers
197 views

What reliable methods are available for tracing the source of an ARP poisoning attack?

If an attacker on the network attempts to use ARP poisoning (spoofing) in order to redirect traffic to his own machine, what mechanisms and techniques are available for tracking the spoofed ARP ...
3
votes
2answers
326 views

Packet Checksums

I recently learned that every packet includes checksum bytes and that the computer will request the packet again if the checksums don't match. How do the following attacks defeat such a safeguard? ...
1
vote
1answer
75 views

Does Ettercap exploit the Hole196 vulnerability?

If not, how is an ARP attack possible on a WPA2 secured network?
0
votes
2answers
62 views

Edit Ettercap password sniffer engine?

I'm using Ettercap as MITM for testing on sniffing password but I'm not getting some POST request data containing "usuario" (user in spanish) and "clave" (password in spanish). I'd like to know if ...
1
vote
0answers
39 views

arpspoof Delay Time between replies

"arpspoof" arp replies every second and I think about what is a reasonable time to send arp replies without affecting the network performance, or just making arpspoof not so noticiable. Is there any ...
2
votes
1answer
185 views

DNS packets during ARP poisoning

I carried out an arp poisoning attack from my virtual machine to real machine with cain and able and collected data with wireshark from real machine. While I was investigating data with wireshark I ...
-1
votes
1answer
51 views

Why does the router fall when performing ARP Poisoning?

I am using dsniff and ettercap and when I start ARP Poisoning the router falls. Why does that happen? I think I might be overwhelming it or there is a problem with the router.
4
votes
2answers
248 views

Bypassing Trustwave NAC

I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network. I would like to know if there are any possible ways to ...
0
votes
0answers
72 views

Mobile traffic sniffing using Cain

As far as I know - and please correct me if I'm wrong - Cain does not support WiFi cards. So if an attacker wants to perform ARP poisoning without being connected through Ethernet to the ...
1
vote
2answers
97 views

MITM is impossibile when the gateway's arp entry is set to static?

As stated in the title. In my lab I am trying to arpspoof a so called "victim pc" that is using Windows 7. I do arp spoofing with arpspoof, but once run arp -a on the victim I see that the gateway ...
3
votes
3answers
191 views

Detect arp-cache poisioner / spoofer

The situation is: a hall full of 200-300 people, one of them is performing an arp-cache poisioning attack. Or messing with my network over wifi in any way. Is there a way how to determine the ...
4
votes
4answers
602 views

Unicast ARP Requests: Considered Harmful?

I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not ...
1
vote
2answers
153 views

How does police or somebody find out that an Arp Spoofing attack was done?

If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see ...
1
vote
0answers
88 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
1
vote
1answer
445 views

Why is ettercap targetting the whole network?

I recently tried to do a MiTM attack on my network using ettercap. I have a router, two windows 7 machines : Host A and Host B, and Backtrack on a VM. In the ettercap window I added the router as ...
1
vote
1answer
167 views

Why ARP Poising is not working for some sites?

I am using following link for arp poisoning our Wireless LAN. http://www.irongeek.com/i.php?page=security/ettercapfilter But the thing is, it is working only for some sites. Even some some http sites ...
2
votes
2answers
189 views

Why the ARP entry of the router recover so quickly after ARP poisoning?

I use Cain to ARP spoof my host and the router. Then I use arp -an to show the ARP entries on my host. For a second or two, I can see the router's MAC address is changed to the address of the ...
1
vote
2answers
132 views

Can non-https assets be tampered with?

Why load assets such as images, javascript, css etc, over HTTPS? Is it possible for these assets to be tampered with if I use HTTP? The only way I could conceive of tampering with HTTP loaded assets ...
1
vote
2answers
459 views

arp request to a ghost host

All the clients in my wireless network send continuously arp requests to a host that doesn't exist (I've checked its absence with nmap -PN [IP]). The clients use windows 7 and windows xp (here the ...
1
vote
1answer
212 views

MiTM not working --rejected by router?

I have been attempting to run a MiTM on a very old XP SP3 computer. I have attempted it with 3 products, as listed below: Wireshark: Traffic from the computer did not even show up. (I did see traffic ...
2
votes
1answer
435 views

Why am I unable to connect to an address spoofed with arpspoof?

I wanted to see how many combinations of websites and browsers are still vulnerable to a tls stripping attack (like, by implementing HSTS or disabling cleartext HTTP altogether). To do it I wanted to ...
0
votes
2answers
2k views

How to prevent other hosts on the same LAN from seeing my IP and host name?

I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
1
vote
3answers
5k views

how to prevent arp poisoning on my network?

Some users on my network using wifikill or netcut to prevent other users from accessing the internet [ ISP's router: public IP ] - [ gateway: public IP eth1 - network eth0 (NAT) ] - [ switch and ...
-1
votes
1answer
241 views

Man in the middle attack [duplicate]

How data can be modified in a man in the middle attack? is there any video demonstrating that,any how to guide,i need practical material ,i have used cain and abel,ettercap but now i am strucked i ...
1
vote
2answers
3k views

ARP poisoning between a wired and wireless network

How can a ARP-Poisoning attack work in a mixed (wireless and wired) network? Assuming that the attacker is connected to the network via wireless connection and the target is a computer connected to ...
0
votes
1answer
2k views

Wireshark Gratuitous ARP

I'm playing around with scapy and wireshark and I have sent a packet to a destination that does not exist (10.0.2.14). Wireshark shows an ARP attempt to resolve the address but as its not there the ...
0
votes
2answers
968 views

Cain and Abel Sniffing vs APR

I have recently been performing a security audit at work (sanctioned of course) and have seen some interesting behaviour from Cain and Abel. I've purposefully avoided using APR so that my co-workers ...
0
votes
1answer
367 views

Network ARP poisoned with Cain but Fiddler not modifying HTML.

The Situation I have successfully used Cain to ARP poison my phone and traffic is being routed via my PC. I have confirmed this in Wireshark and Cain is also able to recover passwords for my SMTP and ...
-3
votes
1answer
239 views

ARP Poisoning effects [closed]

On a normal data exchange of the address resolution protocol (ARP), which steps of the exchange are affected by the ARP Poisoning attack? If anybody would be able to answer this or show me a link ...
6
votes
1answer
142 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
1
vote
1answer
365 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university ...
3
votes
2answers
410 views

What is the disadvantage of using spoofing protected version of ARP protocol

I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
6
votes
2answers
2k views

How to hack a switch connected network with static ARP?

For example, if there is a network with three computers connected to the same switch, Alice, Bob, and Eve. If Alice and Bob add each other on their own ARP list as a static ARP entry, and Eve wants to ...
5
votes
1answer
1k views

Is it possible that my home router is preventing my ARP poisoning attack?

As part of a school project I am trying to do a MITM attack on my local network using ARP poisoning. I choose a target and then I send a spoofed ARP packet to it and to the router every 100 ...
0
votes
1answer
84 views

Finding Ip from an ether adress [closed]

I am using cocoa packet analyser because I am suspecting some intrusion. I find one special packet corresponding to arp protocol with some special ether adress. How could I find the ip related to this ...
1
vote
2answers
359 views

Can I encrypt the packets that are sent to my router?

Is there a way to encrypt HTTP traffic to avoid man-in-the-middle attacks? I use Google Chrome.
2
votes
1answer
956 views

Victim system's internet connection slow after ARP spoof?

I've been using Nemesis 1.4 to test ARP spoofing on a local victim machine. I've been spoofing both the victim machine and the default gateway to ARP redirect to my machine. Spoofing victim's source ...
2
votes
1answer
445 views

Ettercap (dns_spoof)

I need to prove to my boss that he has a vulnerability to a mitm vector on his network. To do so I have been trying to configure ettercap with dns_spoof as an example. When I run the attack on myself ...
0
votes
2answers
2k views

Should ettercap make the targets this slow?

I recently started experimenting with ettercap, however, I quickly noticed that when I try and arp poison targets they can almost never communicate with each other. Is this normal? My computer is a ...
6
votes
2answers
3k views

arp spoofing protection on LAN

I am a network administrator in company. I read this article eject any wifi device from network with android Some of employers are using mobile phones and company`s wireless network. Theses employers ...
3
votes
1answer
611 views

Prevent Arp Cache Attack

Don't know that Am I really under this attack or not, eSet (ESS 5.0) several times is reporting this to me. What I should mention are : Here are using a Wireless point-to-point to get Internet to ...
4
votes
3answers
4k views

Doesn't an IP conflict occur when ARP spoofing?

I am playing around with Ettercap and ARP spoofing attacks. I have noticed that the computers that are involved in my attack not are displaying any messages telling that an IP conflict has occured. ...