Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ping out a packet with a specific content (just a string) to a website, and me, as the bad guy, is supposed to sniff out those packets and tell him the string the next time we meet. Having said my purposes, here are my questions:
Is it possible to sniff out a remote network's traffic, provided that I have admin access over the router/modem? (We thought of exploiting the static routing and forwarding all traffic to a remote server, then said server will forward his traffic to his ISP. We also thought of the same thing, but instead of forwarding directly to the ISP, we somehow return the traffic to the router and let it take care of the ISP business)
How feasible is the attack vector we thought of? (We considered the impact on the network bandwidth, but we will ignore this fact for now.) ----Are there existing services that do exactly this? (act as a sort of man-in-the-middle server)
If it is possible, what other attack methods are available out there? How difficult would this be to implement? (consider the above-average, computer literate, logical Joe)
How detectable would those attacks be? (The ones we thought of are clear as daylight; connection would almost grind to a halt on heavy traffic)
I already read this, but I don't think the user has admin access over the network. Mirroring is not allowed, as not all routers have this feature (but ours has this).
Update: A few years later, I realized that anything is possible. I was able to root my own router, gain telnet access, then gain ssh access, and finally run a program as root, using an unsanitized input field (diagnostics -> ping) while using a non-privileged account.
The router involved was a TP-Link Archer C2. It was running some sort of Unix on MIPS. The program used was
udp2raw compiled specifically for MIPS.