MITM/Wired - Revision history

Admin: /* Nutshell: Classic vs. Modern */

2026-06-19T14:27:22Z

Nutshell: Classic vs. Modern

← Older revision		Revision as of 14:27, 19 June 2026
Line 224:		Line 224:
	=Nutshell: Classic vs. Modern=		=Nutshell: Classic vs. Modern=

	{\| class="wikitable"		{\| class="wikitable" border="1"
	\|-		\|-
	! Aspect !! Classic (1990s–2000s) !! Modern (2010s–Present)		! Aspect !! Classic (1990s–2000s) !! Modern (2010s–Present)

Admin: Major revision: reorganized around classic (1990s-2000s) vs modern (2010s-present) approaches; added switch fundamentals, CAM/MAC flooding, modern tools (Bettercap/mitmproxy/Responder), modern switch defenses (DAI/DHCP snooping/802.1X/port security), modern OS & browser protections (HSTS, CT, DoH, ARP hardening), detection tools, IPv6 considerations, and a comparison table. (via update-page on MediaWiki MCP Server)

2026-06-19T14:04:31Z

Major revision: reorganized around classic (1990s-2000s) vs modern (2010s-present) approaches; added switch fundamentals, CAM/MAC flooding, modern tools (Bettercap/mitmproxy/Responder), modern switch defenses (DAI/DHCP snooping/802.1X/port security), modern OS & browser protections (HSTS, CT, DoH, ARP hardening), detection tools, IPv6 considerations, and a comparison table. (via update-page on MediaWiki MCP Server)

Show changes

Unknown user: Admin moved page Man in the Middle/Wired to MITM/Wired

2022-03-05T20:40:01Z

Admin moved page Man in the Middle/Wired to MITM/Wired

← Older revision	Revision as of 20:40, 5 March 2022
(No difference)

Admin: /* Tools */

2016-08-21T03:32:58Z

Tools

← Older revision		Revision as of 03:32, 21 August 2016
Line 68:		Line 68:
	[[Arpspoof]] - a command-line utility for ARP poisoning.		[[Arpspoof]] - a command-line utility for ARP poisoning.

			=Flags=

	{{MITMFlag}}		{{MITMFlag}}

			{{MITMLabsFlag}}

Admin: /* Wired Networks */

2016-08-21T01:40:13Z

Wired Networks

← Older revision		Revision as of 01:40, 21 August 2016
Line 1:		Line 1:
	Man in the middle attacks on wired networks.		Man in the middle attacks on wired networks.

	=Wired Networks=		=Review of How Wired Networks Work=

	On wired networks, ~~we have~~ a ~~couple~~ of ~~different ways~~ the network can be ~~configured~~.		Let's start with a little review of how wired networks actually work. Ultimately network communications boils down to a series of on-off voltages that travel through conductors (the wires in your network cable). These voltages are processed, passed on, modified, forwarded, and routed by networking infrastructure. Conducting a man-in-the-middle attack on a wired network requires knowing how nodes on a network create a representation of the network, and how that representation can be spoofed.

	==~~Network Near Neighbor~~==		==MAC + IP = ARP==

			The basic target of a wired network man in the middle attack is the ARP table. This is a table maintained by each node on a network that maps IP addresses to MAC addresses. During normal operation of the network, nodes sending or receiving packets use the ARP table to link physical devices to specific ports to help route traffic. (For example, if my ARP table says that Alice is on port 5, and I want to send a message to Alice, I put port 5 into the header of my message, and my computer and the network ensure it gets to Alice and only Alice.)

			==Attacking ARP==

	~~The first scenario is~~ that ~~the attacker is a near-neighbor of the target. This means the attacker and the sheep that is the target of the attack are both connected directly to a router or network switch (see diagram below)~~.		There are several attacks that can be carried out on ARP tables, depending on your objective.

	[[~~Man in the Middle/Wired/~~ARP Poisoning]] ~~- an~~ ARP ~~poisoning~~ attack ~~works~~ in ~~this case~~.		The most basic kind of attack is an [[ARP Poisoning]] or ARP spoofing attack, in which an attacker convinces the gateway and the client that they are talking to each other, but in fact each of their ARP tables has been poisoned so that they are actually sending and receiving messages from the attacker.

	~~<pre>~~		Another type of attack is an ARP table overflow, which is useful for turning network switches (which broadcast traffic selectively to specific ports) into network hubs (which broadcast all traffic to all ports). In this type of attack, special packets create multiple fake entries in the switch's ARP table, until the table is completely full. Once that happens, the network switch can't find other clients, and so broadcasts all traffic to all ports.
	~~+----[Target computer]~~
	\|
	~~\| +---[Attack computer]~~
	~~\| \|~~
	~~\| \|~~
	~~[Router]~~
	~~</pre>~~

	This configuration requires a man in the middle attack to proceed by ARP spoofing, in which the attacker changes the router/network switch table that maps MAC addresses to IP addresses. This allows the attacker to send/receive traffic, and pass it through to another computer on the network (the target).		=MITM Scenarios=

	==Network Tap==		==Network Tap==
Line 39:		Line 36:
	[Router]		[Router]
	</pre>		</pre>

			This is a Physical Layer 1 attack.

			==Network Near Neighbor==

			The first scenario is that the attacker is a near-neighbor of the target. This means the attacker and the sheep that is the target of the attack are both connected directly to a router or network switch (see diagram below).

			[[Man in the Middle/Wired/ARP Poisoning]] - an ARP poisoning attack works in this case.

			<pre>
			+----[Target computer]
			\|
			\| +---[Attack computer]
			\| \|
			\| \|
			[Router]
			</pre>

			With this type of configuration, a MITM attack can be carried out via ARP spoofing. [[Arpspoof]] or [[Ettercap]] are the tools for this type of job.

	=Tools=		=Tools=

Admin: /* Other Attacks */

2016-08-21T01:31:19Z

Other Attacks

← Older revision		Revision as of 01:31, 21 August 2016
Line 39:		Line 39:
	[Router]		[Router]
	</pre>		</pre>

	~~==Other Attacks==~~

	~~[[Man in the Middle/Wired/Port Stealing]]~~

	~~[[Man in the Middle/Wired/DHCP Spoofing]]~~

	~~[[Man in the Middle/Wired/NDP Poisoning]]~~

	=Tools=		=Tools=

Admin: /* Network Tap */

2015-08-29T17:30:52Z

Network Tap

← Older revision		Revision as of 17:30, 29 August 2015
Line 26:		Line 26:
	The network tap scenario is one in which the attacker must have physical access to the wired network. They are physically conducting a man-in-the-middle attack by using two network devices, one connected to the sheep, one connected to the gateway, ''		The network tap scenario is one in which the attacker must have physical access to the wired network. They are physically conducting a man-in-the-middle attack by using two network devices, one connected to the sheep, one connected to the gateway, ''

	~~See~~ [[Man in the Middle/Wired/Network Tap]] ~~page~~		[[Man in the Middle/Wired/Network Tap]] - you can build a bridge between the two network devices, and sniff traffic crossing the bridge

	In the network tap setup, the attacker physically sits between the sheep and the network router or network switch:		In the network tap setup, the attacker physically sits between the sheep and the network router or network switch:

Admin: /* Tools */

2015-08-29T16:55:52Z

Tools

← Older revision		Revision as of 16:55, 29 August 2015
Line 50:		Line 50:
	=Tools=		=Tools=

	[[Ettercap]] - for setting up and executing a man in the middle attack ~~via~~ ARP ~~cache~~ poisoning ~~(among other methods)~~		[[Ettercap]] - for setting up and executing a man in the middle attack. It has a variety of different methods that include ARP poisoning.

	[[Wireshark]] - for viewing packets and plaintext HTTP traffic during a man in the middle session		[[Wireshark]] - for viewing packets and plaintext HTTP traffic during a man in the middle session
Line 56:		Line 56:
	[[Driftnet]] - for viewing images during a man in the middle session		[[Driftnet]] - for viewing images during a man in the middle session

			[[Dsniff]]

			[[Arpspoof]] - a command-line utility for ARP poisoning.


	{{MITMFlag}}		{{MITMFlag}}

Admin: /* Wired Networks */

2015-08-29T16:54:18Z

Wired Networks

← Older revision		Revision as of 16:54, 29 August 2015
Line 1:		Line 1:
			Man in the middle attacks on wired networks.

	=Wired Networks=		=Wired Networks=

	~~Man in the Middle attacks on~~ wired networks ~~can happen with two different configurations~~, ~~each requiring~~ different ~~strategies:~~		On wired networks, we have a couple of different ways the network can be configured.
	* Network Neighbor setup
	* Network Tap setup

	==Network Neighbor==		==Network Near Neighbor==

	~~See [[Man in~~ the ~~Middle/Wired/ARP Poisoning]] page~~		The first scenario is that the attacker is a near-neighbor of the target. This means the attacker and the sheep that is the target of the attack are both connected directly to a router or network switch (see diagram below).

	~~The Network Neighbor setup involves~~ an ~~attacker and a sheep that are both connected directly to a router or network switch:~~		[[Man in the Middle/Wired/ARP Poisoning]] - an ARP poisoning attack works in this case.

	<pre>		<pre>
Line 23:		Line 23:

	==Network Tap==		==Network Tap==

			The network tap scenario is one in which the attacker must have physical access to the wired network. They are physically conducting a man-in-the-middle attack by using two network devices, one connected to the sheep, one connected to the gateway, ''

	See [[Man in the Middle/Wired/Network Tap]] page		See [[Man in the Middle/Wired/Network Tap]] page
Line 38:		Line 40:
	</pre>		</pre>

			==Other Attacks==

			[[Man in the Middle/Wired/Port Stealing]]

			[[Man in the Middle/Wired/DHCP Spoofing]]

			[[Man in the Middle/Wired/NDP Poisoning]]

	=Tools=		=Tools=

Admin at 06:04, 28 August 2015

2015-08-28T06:04:39Z

← Older revision		Revision as of 06:04, 28 August 2015
Line 39:		Line 39:


			=Tools=

			[[Ettercap]] - for setting up and executing a man in the middle attack via ARP cache poisoning (among other methods)

			[[Wireshark]] - for viewing packets and plaintext HTTP traffic during a man in the middle session

			[[Driftnet]] - for viewing images during a man in the middle session



	{{MITMFlag}}		{{MITMFlag}}