6

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address.

I'm trying to demonstrate to a business owner why he needs to secure his network, but he says since I can't 'capture enough data to be useful he sees no reason to put a simple password on his router.

Is there any way to spoof only the router's IP address, redirecting all traffic through you?

I'm using Kali Linux 1.10.

  • 4
    You can specify the netblock as the "victim". – schroeder Aug 31 '15 at 15:15
  • 2
    Not sure if this is the modern way to do things, but have you considered ARP spoofing? – Paul Sep 1 '15 at 4:54
  • @Paul I'm using arpspoof on kali – Hellreaver Sep 1 '15 at 6:52
  • @schroeder getting a segmentation fault when using, for example, 192.168.0.1/24 as well as 192.168.0.1-255 – Hellreaver Sep 1 '15 at 14:32
  • 2
    Please read the man page for arpspoof: -t target Specify a particular host to ARP poison (if not specified, all hosts on the LAN). – schroeder Sep 1 '15 at 14:39
2

There are various attacks you can demonstrate in the local network to make your point clear. You can do the classics like ARP-Spoffing, a rogue DHCP-Server or macflooding. Macflooding will cause the switch either to go into fail-open mode which basicly turns it into a hub or in fail-off which turns your MITM attempet into a DOS attack so it's kind of a risky thing to do.

In my experience in a windows network NBNS/LLMNR-Spoofing in combination with WPAD Redirection and force NTLM-Authentification is very effective (sadly it doesnt have anything to do with the switch/router but I think buissnes guy doens't know that...). There is a pretty great implementation of this attack in a tool called Responder. You can bringt internet explorer users send you their NTML hashes so the only thing you have to do is collect them, crack them or pth them. I consider the key to his account might be what he calles "useful data"...

1

For a nice visual demonstration you can use the graphical interface of Ettercap (ettercap -G) in combination with Wireshark or mitmproxy to run several types of MiTM attacks. There are several plugins for Ettercap which could help you with the demonstration.

I'm trying to demonstrate to a business owner why he needs to secure his network, but he says since I can't 'capture enough data to be useful he sees no reason to put a simple password on his router.

As long the traffic is not encrypted, the password can be sniffed anyway. Beware that it's not an easy task to defend a network against MiTM attacks, just in case the demonstration was good and your customer is asking for it.

  • Hellreaver's problem is that he can only get the data from a single host. He's asking how to spoof more hosts. – schroeder Sep 1 '15 at 14:40
  • 1
    I didn't wanted to post RTFM. Rather I tried to show a move convenient way to solve the problem. – Noir Sep 1 '15 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.