2

in a scenario where I have a gateway to the Internet and a switch(layer 2) connected to this gateway. I have two computers in the same broadcast domain connected to the switch. all traffic to the Internet has to go through the gateway.

from one of the computers I ARP poison the other by sending false ARP reply's indicate this computer is the gateway. so now one of the computers thinks the other is the gateway. then I ARP poison the gateway for this same victim computer and now one of the computer is acting like MITM this is working and I can see the ARP caches have changed MAC address. all internet traffic can be sniffed (ignore SSL for this experiment). only traffic issued via the gateway can be sniffed as one computer is in the middle.

let's say a web server is added to the switch and the traffic from both computers on the same switch do not have to go through the gateway to access the web server because the switch has an CAM table and traffic from computer goes to switch and the switches CAM cache says MAC address is on port x so basically traffic does not go via gateway. in this scenario how does one act as MITM ?

do you arp poison or something similar the switch it is a layer 2 switch? how do arp poison a switch for a MITM attack ?

I feel like I am missing something simple

my experiment allowed me to sniff all traffic going to the Internet but I could not sniff the traffic going to the web server sitting on the switch. maybe I "simply" arp poison the web server arp cache and again arp cache the victim computer ?

yes port forwarding is enabled just in case it's asked.

Improve this question

1 Answer 1

Reset to default
2

The basic idea is simple as you've mentioned, MITM works in ARP spoofing scenario as follows:

To perform MITM between A and B:

  1. Trick A to think you're B
  2. Trick B to think you're A
  3. Enable packets forwarding

That's it! so regardless of your environment, whether it's a switch or hub or even a proxy server, the principle is same.

So, the answer to your question is: Yes. You have to perform the attack between the victim and the server that's run on the same network. And for each server you put on this network, you'll have to do the same.

PS:It's not a good idea, but you can use what's so called 'Hail Mary' ARP spoofing attack, basically you run ARP spoofing on all local devices and claiming to be one or more device. In that way, all the devices will be tricked to believe that the attacker is the server, the gateway and all other important machines.

Improve this answer
2
  • cheers dude, indeed a flood of ARP to all devices is not a good idea, on a large LAN subnet I would imagine this would turn into a DOS i.e. all traffic flowing to the same MAC address.
    – Darragh
    Commented Jul 27, 2016 at 7:19
  • Yes you can use this method to achieve multi attacks, but I had to do it once on a large scale network and it's effective, specially with a presence of a proxy server.
    – Eibo
    Commented Jul 27, 2016 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .