MITM/Wired

Man in the middle attacks on wired networks.

Wired Networks

On wired networks, we have a couple of different ways the network can be configured.

Network Near Neighbor

The first scenario is that the attacker is a near-neighbor of the target. This means the attacker and the sheep that is the target of the attack are both connected directly to a router or network switch (see diagram below).

Man in the Middle/Wired/ARP Poisoning - an ARP poisoning attack works in this case.

+----[Target computer]
|
|      +---[Attack computer]
|      |
|      |
[Router]

This configuration requires a man in the middle attack to proceed by ARP spoofing, in which the attacker changes the router/network switch table that maps MAC addresses to IP addresses. This allows the attacker to send/receive traffic, and pass it through to another computer on the network (the target).

Network Tap

The network tap scenario is one in which the attacker must have physical access to the wired network. They are physically conducting a man-in-the-middle attack by using two network devices, one connected to the sheep, one connected to the gateway,

Man in the Middle/Wired/Network Tap - you can build a bridge between the two network devices, and sniff traffic crossing the bridge

In the network tap setup, the attacker physically sits between the sheep and the network router or network switch:

    +--------[Target computer]
    |
    |
[ Attack computer ]
    |
    |
[Router]

Other Attacks

Man in the Middle/Wired/Port Stealing

Man in the Middle/Wired/DHCP Spoofing

Man in the Middle/Wired/NDP Poisoning

Tools

Ettercap - for setting up and executing a man in the middle attack. It has a variety of different methods that include ARP poisoning.

Wireshark - for viewing packets and plaintext HTTP traffic during a man in the middle session

Driftnet - for viewing images during a man in the middle session

Dsniff

Arpspoof - a command-line utility for ARP poisoning.