5

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address.

I'm trying to demonstrate to a business owner why he needs to secure his network, but he says since I can't 'capture enough data to be useful' he sees no reason to put a simple password on his router.

Is there any way to spoof only the router's IP address, redirecting all traffic through you?

I'm using Kali Linux 1.10.

Improve this question
5
  • 4
    You can specify the netblock as the "victim".
    – schroeder ♦
    Aug 31, 2015 at 15:15
  • 3
    Not sure if this is the modern way to do things, but have you considered ARP spoofing?
    – Paul
    Sep 1, 2015 at 4:54
  • @Paul I'm using arpspoof on kali
    – Hellreaver
    Sep 1, 2015 at 6:52
  • @schroeder getting a segmentation fault when using, for example, 192.168.0.1/24 as well as 192.168.0.1-255
    – Hellreaver
    Sep 1, 2015 at 14:32
  • 2
    Please read the man page for arpspoof: -t target Specify a particular host to ARP poison (if not specified, all hosts on the LAN).
    – schroeder ♦
    Sep 1, 2015 at 14:39

2 Answers 2

Reset to default
2

There are various attacks you can demonstrate in the local network to make your point clear. You can do the classics like ARP-Spoffing, a rogue DHCP-Server or macflooding. Macflooding will cause the switch either to go into fail-open mode which basicly turns it into a hub or in fail-off which turns your MITM attempet into a DOS attack so it's kind of a risky thing to do.

In my experience in a windows network NBNS/LLMNR-Spoofing in combination with WPAD Redirection and force NTLM-Authentification is very effective (sadly it doesnt have anything to do with the switch/router but I think buissnes guy doens't know that...). There is a pretty great implementation of this attack in a tool called Responder. You can bringt internet explorer users send you their NTML hashes so the only thing you have to do is collect them, crack them or pth them. I consider the key to his account might be what he calles "useful data"...

Improve this answer
1

For a nice visual demonstration you can use the graphical interface of Ettercap (ettercap -G) in combination with Wireshark or mitmproxy to run several types of MiTM attacks. There are several plugins for Ettercap which could help you with the demonstration.

I'm trying to demonstrate to a business owner why he needs to secure his network, but he says since I can't 'capture enough data to be useful he sees no reason to put a simple password on his router.

As long the traffic is not encrypted, the password can be sniffed anyway. Beware that it's not an easy task to defend a network against MiTM attacks, just in case the demonstration was good and your customer is asking for it.

Improve this answer
2
  • 1
    Hellreaver's problem is that he can only get the data from a single host. He's asking how to spoof more hosts.
    – schroeder ♦
    Sep 1, 2015 at 14:40
  • 1
    I didn't wanted to post RTFM. Rather I tried to show a move convenient way to solve the problem.
    – Noir
    Sep 1, 2015 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .