MITM/Wired/MAC Flood: Difference between revisions
From charlesreid1
(Created page with "One way to cause chaos in a wireless router or switch that you're trying to attack is to overwhelm it with MAC addresses. Eventually, the number of devices will become so larg...") |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
=Overview= | |||
==MAC Addresses== | |||
A MAC address is a digital fingerprint that is associated uniquely with a physical device. In theory, no two mac addresses should be the same. In practice, the MAC address can be controlled and spoofed. | |||
MAC addresses are important on local networks because the DHCP server (or router) needs some way to identify different machines in order to hand out IP addresses. The MAC address is associated with OSI Level 2 (Device), while the IP address is associated with OSI Level 3 (Network). | |||
==CAM Table== | |||
It is important for a router or DHCP server to keep track of the different MAC addresses it has seen, so that it can recognize a returning device versus new devices. To do that, the router uses a CAM table, which is a table of all MAC addresses the router has seen. | |||
The CAM table is the weak point of the system - if the CAM table breaks, then the router can't properly keep track of what MAC addresses it has seen before, or which MAC addresses have been assigned which IP addresses. | |||
==MAC Flood Attack== | |||
Once the CAM table is broken, an ARP spoofing attack becomes possible - the attacker sends ARP packets to the router that instruct it to associate the victim IP address with the attacker MAC address, routing all victim traffic to the attacker machine. | |||
The MAC flood attack targets the CAM table. It generates a large number of random MAC addresses in order to flood the CAM table with junk and break the link between Layer 2 and Layer 3. | |||
==Tools== | |||
See [[Macof]] for a tool to perform MAC flooding attacks. Macof is part of the [[Dsniff]] suite of tools. | |||
=Links= | |||
=Flags= | |||
{{MITMFlag}} | |||
{{KaliFlag}} | |||
Latest revision as of 20:52, 5 March 2022
Overview
MAC Addresses
A MAC address is a digital fingerprint that is associated uniquely with a physical device. In theory, no two mac addresses should be the same. In practice, the MAC address can be controlled and spoofed.
MAC addresses are important on local networks because the DHCP server (or router) needs some way to identify different machines in order to hand out IP addresses. The MAC address is associated with OSI Level 2 (Device), while the IP address is associated with OSI Level 3 (Network).
CAM Table
It is important for a router or DHCP server to keep track of the different MAC addresses it has seen, so that it can recognize a returning device versus new devices. To do that, the router uses a CAM table, which is a table of all MAC addresses the router has seen.
The CAM table is the weak point of the system - if the CAM table breaks, then the router can't properly keep track of what MAC addresses it has seen before, or which MAC addresses have been assigned which IP addresses.
MAC Flood Attack
Once the CAM table is broken, an ARP spoofing attack becomes possible - the attacker sends ARP packets to the router that instruct it to associate the victim IP address with the attacker MAC address, routing all victim traffic to the attacker machine.
The MAC flood attack targets the CAM table. It generates a large number of random MAC addresses in order to flood the CAM table with junk and break the link between Layer 2 and Layer 3.
Tools
See Macof for a tool to perform MAC flooding attacks. Macof is part of the Dsniff suite of tools.
Links
Flags
 |
monkey in the middle attacks in which an attacker tricks two parties into thinking they're communicating with each other, but both are communicating with the attacker.
Wireless Attacks: MITM/Wireless Wired Attacks: MITM/Wired
Layer 1 and 2 MITM Attacks: Network Tap: MITM/Wired/Network Tap Evil Twin Attack: Evil Twin · MITM/Evil Twin
Layer 3 and 4 MITM Attacks:
ARP Poisoning: MITM/ARP Poisoning Traffic Injection/Modification: MITM/Traffic Injection DNS Attacks: MITM/DNS · Bettercap/Failed DNS Spoofing Attack · Bettercap/Failed DNS Spoofing Attack 2 DHCP Attacks: MITM/DHCP WPAD MITM Attack: MITM/WPAD Port Stealing: MITM/Port Stealing Rushing Attack: MITM/Rushing Attack Attacking HTTPS: MITM/HTTPS
Session Hijacking: MITM/Session Hijacking
Toolz:
SSLSniff · SSLStrip · Frankencert
MITM Labs: {{MITMLabs}}
Category:MITM · Category:Attacks · Category:Kali Attack Layers Template:MITMLabs · Template:MITMFlag Flags · Template:MITMFlag · e |