2

Let's say that we have our computer inside the local network. Our local network is connected to the Internet by AP+Router that connects to the router in other network which is connected to the ISP. Now, I'd like to know if there is any chance that we can listen to the traffic between AP+Router and Router(in other network) from our local network?

  • No. The router in your local network is your gateway - you send all the traffic that is not destinated for your LAN (your computer determines that looking at subnet mask) to the address, configured as your default gateway in order to be routed to it's destination. Every host on LAN do the same if something other isn't configured. So, what happens next is router's job and is not under your control, no matter if the router acts as a simple bridge and route the traffic to the ISP network on the WAN port or pass it to another router that manages another LAN segment. – programings Nov 3 '14 at 0:00
3

No, you won't be able to do a MITM attack on the edge router and your access point/router. In order to perform a man in the middle attack you must be on a network segment that allows your device to actually get in between these two routers. As programings already pointed out your gateway is the internal router/access point, which means that without it you cannot get to the edge router or route traffic. In a MITM you are attempting to reroute traffic through you by some means (in this case I imagine your referring to ARP Poisoning?), which is impossible if you cannot get to one of your targets without going through the other.

In order to perform a MITM on these routers you would need to move onto a network segment that is between the edge router and the internal one. You need this due to the fact that ARP Poisoning deals with a flaw in ARP which lives on the second layer of TCP/IP. In your case you don't have access to the second layer that the edge router is working with because you are behind the internal router.

  • 2
    It's not a protocol flaw. That's the only way ARP can work effective. :) – programings Nov 3 '14 at 8:25
0

Potentially yes, but you would need to implement bgp-hijacking

0

Yes you can.

MitM attacks consist of sitting between the connection of two parties and either observing or manipulating traffic.

A classical and well known MITM would involve ARP poisoning, which can only be executed on the same subnet, meaning in this scenario you can't do it from another network.

This doesn't hold true if for example you have taken over control of a victims default DNS server, meaning you can MITM all of those requests.

Also another scenario would be externally compromising the victims internet router (finding open management access through Shodan) and adding a route to your public proxy.

There recently have been many bgp-hijacking attacks as well, where the attackers main purpose is to re-route traffic through his AS router so he can MITM all of the internet traffic.

There are also a bunch of other examples, which you can read up here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.