Tag Info

Hot answers tagged

6

If you have a https page, but load some assets (JavaScript) over plain http, then: Many browsers (recent Chrome versions, maybe also Firefox) won't even load the script by default an attacker can intercept the script, and replace it with — for example — another script that will simply copy the entire <body> contents of your https page, rendering ...


6

Get to the roots ! If you know what ARP does, things will be clearer. On a subnet (machines plugged into the same set of hubs and switches), the machines talk to each other with MAC addresses: the MAC address uniquely identifies each ethernet/WiFi card. Machines, a priori, do not know MAC addresses; they just know IP addresses. So, when machine A wants to ...


5

First, let's clarify what is meant by a static arp entry. The Address Resolution Protocol is used to map the layer 2 address to the layer 3 address, typically this is Ethernet and IP. A static arp entry means that you always expect a specific IP to be at a given hardware address. With a default Windows or Linux implementation, you will be using a TCP/IP ...


5

The attacker can try to flood the MAC table of the switch, and then the switch could fall down in "hub" mode. Then the switch would send the packets of Alice and Bob on all port. So Eve could sniff their network packets. Another way to hack is to poison the switch MAC table. If Eve knows the MAC address of Alice and Bob, Eve could tell the switch that he ...


4

Question is : why the ARP modified versions hasn't been used on large scale yet ? What is the cost of addressing this versus the risk? ARP is a local subnet issue. If someone is already successfully on your LAN you probably have a much bigger problem because they can still do attacks at higher layers of the communications stack. Is this where you want ...


4

When ARP Poisoning You are poisoning the ARP tables. If computer 10.1.1.1 needs to get to computer 10.1.1.2, it keeps the MAC address in its ARP tables. ARP is a trusting protocol, which means when a computer responds to a ARP request, there is nothing requiring its response to be correct and no mechanism for verifying it is correct. So here's the game ...


3

Configure your switch to use Private VLANS (PVLANS). PVLANS basically say that physical ports Gi1/1 - 47 can only talk to physical port Gi1/48 (where your gateway is). Even things on the same subnet must go through the gateway to talk. In a setup with N hosts there is generally no reason for the hosts to talk so a PVLAN config is optimal for security. ...


3

Actually, I disagree with tylerl's answer. It is indeed difficult to hide our IP from other hosts on a LAN, it's very possible. Because you're mentioning netcut (a tool that works by using ARP poisoning), I think you have the following setup: You trying to use the Internet. Router giving you access to the Internet. Other hosts on the same LAN. Some ...


3

Suggest you research the latest Cisco APs. I believe these devices are able to isolate each wireless client from each other and from the network. All client traffic is routed instead of switched. You can then setup ACLs to keep WiFi attached clients from reaching anything they should not have access to. Also most enterprise-grade switches support ...


3

You can't protect a layer-2 network from ARP spoofing. And a single wireless AP consists of a single wireless layer-2 network. I do not know if your wireless AP acts as a bridge (which would propogate the "original" MAC address used by the client wireless card) or a router (which would retransmit using the AP's MAC address). If it's in router mode, then ...


3

Is there a way to encrypt traffic to avoid MITM attacks? Many! Almost every good method for this involves a public/private keypair. To ensure that you are corrected to the correct endpoint, you must know trust the other side's key. If you don't somehow verify the key on the other end of the connection, the value is very limited as an attack can ...


2

May be I am wrong, but try to use wireshark Also I think that this might be useful http://compnetworking.about.com/od/networkprotocolsip/f/convertipmacadd.htm


2

Passive-only attack scenarios tend to be rather specialized. Mostly, they involve radio links; the attacker can play with a homemade reception antenna, but is not rich enough to build an emitter which can drown out the genuine signal. This rarely applies to the Internet; this is more relevant to military on-field communications. It could be argued that ...


2

There is a possibility to encrypt the connection to the proxy, there was a question on this site.Please find the link mentioned below.However the methods mentioned may not work at all times. Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection? To answer your query regarding implementing this on the network infrastructure: ...


2

Regardless of where you are connected, if you are able to do ARP poisoning, that is you let all traffic headed towards the gateway of the network come to you, you will get all traffic and you will be able to intercept it. Q: The router would need to forward the wrong information about its own IP. Doesn't it recognize? In ARP poisoning, you are not ...


2

The answer to your question seems to lie within the link you have referenced. Computer programs follow specific instructions, and in this case the ettercap filter is set to: replace("img src=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); replace("IMG SRC=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); The character string ...


2

ARP poisoning causes the traffic between those hosts to be forwarded through you, as part of the man in the middle attack. This causes performance degradation on the targets for a few reasons: There is increased latency due to the added network hop. Your network card has to send and receive 2 to 4 times as much data as normal, since you're acting as a ...


2

Anyone that can become a man in the middle can perform http manipulation. Check out mitmproxy for an example of how scripts, css, java applets etc can be inserted into an insecure connection. This is possible because http is a plain text protocol and as such can be manipulated by anyone that controls a transit point on any network used to reach your ...


1

If people who are attacked, put in a static arp entry for the router gateway, they would not be able to be poisoned to goto the attackers machine instead as most of these programs do. It does however require that they do that manually. There is no other way unless you have hardware to help you out.


1

Some of the solutions I can think of are: If you know the bad guy, catch hold of him and try to know why is (s)he doing this and maybe block him/her. That is one of the best way to stop the attack. Else, If the network is small, you can use static IP addresses and static ARP tables. " arp -s" command will be useful in that case on your linux machine. ...


1

A gratuitous ARP is basically an ARP response that never had a request for it and is how most ARP spoofing programs work. Normally you send an ARP request and wait for the ARP response. A gratuitous ARP is when you just send your details even though there was no request. These can happen legitimately when say your IP or MAC address change so you can update ...


1

If you're sure that you're on a switch then you should not be receiving packets that you are not the intended recipient for. Have you attempted any APR before and some hosts may still be poisoned? Are you sure that all routes on your network are configured properly? Use Wireshark to determine that you are not broadcasting any gratuitous ARP packets and ...


1

In essence if you are not ARP poisoning "AND" your system is not on a hub, both of which you made sure of, there should be no packets not destined to your IP(s) which should be showing up in your captures. So the key question to look at would be what were the sources and destinations in the packets where you got the passwords/hashes/snmp data from. If they ...


1

I know a few businesses that have implemented the 802.1x (OSI Layer 2 encryption and authentication that prevent attacks such as man and in middle attack). It takes time and money to setup it. Switch can put each port on a separated VLAN, thus preventing man in the middle attack. Why implementing 802.1x to prevent man in the midle attacks when you can save ...


1

From reading this article it appears that nemesis just poisons the arp cache of the victim and gateway to cause them to forward packets to your machine (the middle man). You need to enable IP forwarding (see the previous article or this one for more detail on IP forwarding) on your machine to get the redirected packets forwarded to the correct systems.


1

I found it difficult to understand the exact architecture of your network, so im trying to give somewhat a generic answer for your problem: To make sure if you are being attacked or not, run the arp -a command from one of your computers while ESET alarms you. This command will dump all the ARP records of the computer to the screen. Check against the other ...


1

ARP Spoofing is NOT the same as IP address spoofing. What ARP spoofing does is associate a MAC Address with an existing IP Address. The exploit involves sending fake ARP reply packets that will associate the attackers MAC address with a legitimate IP address. This involves making use of the fact that the ARP protocol is stateless - it doesn't keep track of ...



Only top voted, non community-wiki answers of a minimum length are eligible