Timeline for ARP Poisoning: exactly how it works
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 11, 2017 at 15:33 | comment | added | loopOfNegligence | Yes, I'm on the local network because I have access to it. But, every client connected has a different PTK, right? So, when I (attacker) receive the frames from the victim, how am I able to read the frames just received? It’s because the victim used the PTK of the attacker to encrypt the frames? Or simply because, even if the victim used his own PTK, the attacker is able to calculate the PTK of the victim? | |
| Mar 10, 2017 at 20:19 | comment | added | Shane Andrie | Depends on where you encrypt. In order to actually ARP poison you need to be on the local network (I.E have an IP assigned), So for WiFi you'd either have already sniffed and decrypted the network authentication, or already have access to it. After that it's dependent on the network communication if traffic is encrypted or not. | |
| Mar 9, 2017 at 11:51 | comment | added | loopOfNegligence | "Attacker interprets, sniffs it's data, and sends it on the router." So, when the attacker receives the data from the victim, the traffic is encrypted or already decrypted? I mean, the attacker before forwarding the data to the router, is able to read the received data? | |
| Mar 8, 2017 at 18:38 | history | answered | Shane Andrie | CC BY-SA 3.0 |