Unknown user: Admin moved page Man in the Middle/DHCP to MITM/DHCP

2022-03-05T20:39:06Z

Admin moved page Man in the Middle/DHCP to MITM/DHCP

← Older revision	Revision as of 20:39, 5 March 2022
(No difference)

Admin: /* Tools */

2016-08-23T07:24:14Z

Tools

← Older revision		Revision as of 07:24, 23 August 2016
Line 24:		Line 24:
	* Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server		* Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server
	* DNS Hijacking - hijacking the shee's DNS channel to control where the sheep's requests point them		* DNS Hijacking - hijacking the shee's DNS channel to control where the sheep's requests point them

			=Flags=

			{{MITMFlag}}

Admin: Created page with "=DHCP Attacks= So what is DHCP anyway? DHCP is domain host control protocol - it's how IP addresses get handed out to different devices. ==ACK Injection== ACK injection con..."

2016-08-23T07:23:56Z

Created page with "=DHCP Attacks= So what is DHCP anyway? DHCP is domain host control protocol - it's how IP addresses get handed out to different devices. ==ACK Injection== ACK injection con..."

New page

=DHCP Attacks=

So what is DHCP anyway? DHCP is domain host control protocol - it's how IP addresses get handed out to different devices.

==ACK Injection==

ACK injection consists of an attacker monitoring a DHCP conversation between the DHCP server and a potential network node, and at some point during the conversation, sending a packet to interfere with the conversation. By controlling the DHCP process, the attacker controls the association between the IP address and MAC address of the sheep device - an alternative attack to [[ARP Poisoning]] with the same end.

EvilFOCA converts the attacker machine into a fake DHCP server on the network.

See [[#EvilFOCA]] tool below.

==DNS Hijacking==

DNS Hijacking consists in modifying the way the sheep's DNS system works. This can be achieved at multiple levels (e.g., at the system level, by breaking into and modifying the client's system to permanently point to a pirate DNS server; or at the network level, by conducting a MITM attack on DNS requests.) By poisoning routes, the attacker receives the sheep's DNS requests and can respond to specific DNS requests from the sheep to a destination of the attacker's choosing.

=Tools=

==EvilFOCA==

Link: https://github.com/ElevenPaths/EvilFOCA

Tool for conducting various DNS attacks (and other types of attacks)
* Capable of conducting DHCP ACK Injection - attacker monitors DHCP exchanges, interferes by sending packets, attacker acts as fake DHCP server
* DNS Hijacking - hijacking the shee's DNS channel to control where the sheep's requests point them

MITM/DHCP - Revision history

Unknown user: Admin moved page Man in the Middle/DHCP to MITM/DHCP

Admin: /* Tools */

Admin: Created page with "=DHCP Attacks= So what is DHCP anyway? DHCP is domain host control protocol - it's how IP addresses get handed out to different devices. ==ACK Injection== ACK injection con..."