Scribd Logo
Upload

Welcome to Scribd!

  • 51 views

    General Presentation Topic: Man in The Middle Attack

    Uploaded by

    Vivek Jamwal
    The document discusses a man-in-the-middle (MITM) attack presentation. It defines an MITM attack as when an attacker intercepts communications between two endpoints to inject false information and intercept data. It then describes various MITM techniques like ARP spoofing, DNS spoofing, IP spoofing and port stealing. It also lists some common tools used for launching and testing MITM attacks, such as Ettercap, Dsniff and Yersinia.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd

    General Presentation Topic: Man in The Middle Attack

    Uploaded by

    Vivek Jamwal
    51 views7 pages
    The document discusses a man-in-the-middle (MITM) attack presentation. It defines an MITM attack as when an attacker intercepts communications between two endpoints to inject false information and intercept data. It then describes various MITM techniques like ARP spoofing, DNS spoofing, IP spoofing and port stealing. It also lists some common tools used for launching and testing MITM attacks, such as Ettercap, Dsniff and Yersinia.

    Original Title

    report

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses a man-in-the-middle (MITM) attack presentation. It defines an MITM attack as when an attacker intercepts communications between two endpoints to inject false information and intercept data. It then describes various MITM techniques like ARP spoofing, DNS spoofing, IP spoofing and port stealing. It also lists some common tools used for launching and testing MITM attacks, such as Ettercap, Dsniff and Yersinia.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    51 views7 pages

    General Presentation Topic: Man in The Middle Attack

    Uploaded by

    Vivek Jamwal
    The document discusses a man-in-the-middle (MITM) attack presentation. It defines an MITM attack as when an attacker intercepts communications between two endpoints to inject false information and intercept data. It then describes various MITM techniques like ARP spoofing, DNS spoofing, IP spoofing and port stealing. It also lists some common tools used for launching and testing MITM attacks, such as Ettercap, Dsniff and Yersinia.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 7

    GENERAL PRESENTATION

    TOPIC: MAN IN THE MIDDLE ATTACK

    Submitted by: Submitted to:

    Vivek jamwal Gurbaksh Phonsa

    B2804B43

    10809297
    INDEX

    1) DEFINITION
    2) MEMO

    3) MITM TECHNIQUES
    4) TOOLS
    5) NOTE
    6) REFERENCE
    DEFINITION

    The term "Man-in-the-middle attack" (MITM attack) refers to the type of attack where the
    attacker intrudes into the communication between the endpoints on a network to inject false
    information and intercept the data transferred between them.

    MEMO

     MITM attack is also known as:


    o Bucket-brigade attack
    o Fire brigade attack
    o Monkey-in-the-middle attack
    o Session hijacking
    o TCP hijacking
    o TCP session hijacking
     Name Origin: The name "Man-in-the-Middle" is derived from the basketball scenario
    where two players intend to pass a ball to each other while one player between them
    tries to seize it. MITM attacks are sometimes referred to as "bucket brigade attacks"
    or "fire brigade attacks." Those names are derived from the fire brigade operation of
    dousing off the fire by passing buckets from one person to another between the water
    source and the fire.

    MITM TECHNIQUES

    The techniques used for MITM attacks can be classified below in consideration of the
    following three network environment types:

     Local Area Network


     From Local To Remote (through a gateway)
     Remote

    Local Area Network

     ARP spoofing
    o Briefing: ARP (Address Resolution Protocol) spoofing is also known as "ARP
    poisoning" or ARP Poison Routing. The attacker may use ARP spoofing to
    sniff data frames on LAN and to modify the packets. The attacker may corrupt
    the ARP caches of directly connected hosts and finally take over the IP
    address of the victim host.
    o Tools used:
     ARPoison is a UNIX Command-line tool that can be used to create
    spoofed ARP packets.
     Ettercap can be used for filtering, hijacking, poisoning, sniffing,
    including SSH v.1 sniffing (transparent attack).
     Dsniff can be used for poisoning, sniffing, including SSH v.1 sniffing
    (proxy attack)
     Parasite is a daemon used to watch a LAN for ARP requests and
    automatically send spoofed ARP replies.
     DNS spoofing
    o Briefing: The attacker starts by sniffing the ID of any DNS request, and then
    replies to the target requests before the real DNS server.
    o Tools used:
     ADM DNS spoofing tools can spoof DNS packets via various active
    and passive methods.
     Ettercap (Plugin needed: phantom plugin)
     Dsniff (dnsspoof)
     Zodiac can be used for DNS name server versioning, DNS local
    spoofing (answering DNS queries before the remote name server),
    DNS jizz spoofing, and DNS ID spoofing.
     IP address spoofing
    o Briefing: The attacker creates IP packets with a forged source IP address in
    order to conceal the identity of the packet sender or to impersonate another
    computer system. (This method of attack on a remote system can be very
    difficult, because it involves modifying thousands of packets at a time. This
    type of attack is most effective where trust relationships exist between
    endpoints.)
    o Tools used:
     Hping can be used to prepare spoofed IP datagrams with only a one-
    line command, and the attacker can send the prepared datagrams to
    almost any target victim.
     Spoofed IP
     Port stealing
    o Briefing: The term "Port Stealing" refers to the MITM technique used to spoof
    the switch forwarding database (FDB) and usurp the switch port of the victim
    host for packet sniffing on Layer 2 switched networks. The attacker starts by
    flooding the switch with the forged ARP packets that contain the same source
    MAC address as that of the victim host and the same destination MAC address
    as that of the attacker host. Note that those packets are invisible to other host
    on the same network. Now that the victim host also sends packets to the
    switch at the same time, the switch will receive packets containing the same
    source MAC address with two different ports. Therefore, the switch will
    repeatedly alter the MAC address binding to either of the two ports by
    referencing the relevant information in the packets. If the attacker's packets are
    faster, the switch will send the attacker the packets intended for the victim
    host. Then the attacker sniffs the received packet, stops flooding and sends an
    ARP request for the victim’s IP address. After receiving the ARP reply from
    the victim host, the attacker will manage to forward the "stolen" packet to the
    victim host. Finally, the flooding is launched again for another attacking cycle.
    o Tools used:
     Ettercap (Plugin needed: Confusion plugin)
     STP mangling
    o Briefing: STP (Spanning-Tree Protocol) mangling refers to the technique used
    for the attacker host to be elected as the new root bridge of the spanning tree.
    The attacker may start either by forging BPDUs (Bridge Protocol Data Units)
    with high priority assuming to be the new root, or by broadcasting STP
    Configuration/Topology Change Acknowledgement BPDUs to get his host
    elected as the new root bridge. By taking over the root bridge, the attacker will
    be able to intercept most of the traffic.
    o Tools used:
     Ettercap (Plugin needed: Lamia plugin)
     Yersinia

    From Local To Remote (through a gateway)

     ARP poisoning
     DNS spoofing
     DHCP spoofing (e.g., Spoofing the DHCP Server)* is a type of attack on DHCP
    server to obtain IP addresses using spoofed DHCP messages
     Gateway spoofing (usually, spoofing the default gateway)
     ICMP redirection
     IRDP spoofing - route mangling

    Remote

     DNS poisoning
     Route mangling
     Traffic tunneling

    TOOLS

    The fowllowing tools are commonly used for launching, detecting or testing MITM attacks.

    Ettercap

     Tool Name: Ettercap


     Current Version: NG-0.7.3 (Release Date: May 29, 2005)
     Developer: Alberto Ornaghi, Marco Valleri
     Platform/OS:
    o FreeBSD 4.x 5.x;
    o Linux 2.0.x, 2.2.x, 2.4.x, 2.6.x;
    o Microsoft Windows 2000/XP/2003;
    o NetBSD 1.5;
    o OpenBSD 2.[789], 3.x;
    o OS X (darwin 6.x, 7.x);
    o Solaris 2.x.
     Commercial or Freeware: Freeware
     URL: ettercap.sourceforge.net
     Briefing: Ettercap is a multipurpose hacking suite for the switched LAN environment.
    As a LAN-based sniffer, interceptor and logger, it is chiefly featured by live-
    connection sniffing and content filtering on the fly. It supports the active and passive
    dissection of many protocols (even the ciphered ones) and includes some
    functionalities for network and host analysis. Ettercap can be used to launch an MITM
    attack via ARP poisoning or port stealing.
    Dsniff

     Tool Name: Dsniff


     Current Version: 2.3 (Release Date: December 19, 2000)
     Developer: Dug Song
     Platform/OS:
    o OpenBSD (i386);
    o Redhat Linux (i386);
    o Solaris (sparc).
     Commercial or Freeware: Freeware
     URL: www.monkey.org/~dugsong/dsniff
     Briefing: Dsniff is claimed as a tool suite developed for network auditing and
    penetration testing, but the attacker can use it for SSL MITM attacks. Its components
    "dsniff", "filesnarf", "mailsnarf", "msgsnarf", "urlsnarf", and "webspy" can be used to
    passively monitor a network for sensitive data (e-mail, files and passwords). Its other
    components like "arpspoof", "dnsspoof", and "macof" allow the attacker to intercept
    network packets normally unavailable to the attacker. Its components "SSHMITM"
    and "WEBMITM" may help the attacker to launch active man-in-the-middle attacks
    against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc
    PKI.

    Yersinia

     Tool Name: Yersinia


     Current Version: 0.7.1 (Release Date: May 8, 2007)
     Developer: Alfredo Andrés Omella (Slay), David Barroso Berrueta (tomac)
     Platform/OS:
    o Linux 2.4.x and 2.6.x;
    o Mac OSX 10.4 Tiger (Intel);
    o OpenBSD 3.4 (note: upgrade your pcap libraries to at least 0.7.2);
    o Solaris 5.8 64bits SPARC.
     Commercial or Freeware: Freeware
     URL: www.yersinia.net
     Briefing: Yersinia takes its name from the bacteria "Yersinia pestis." It can be used to
    exploit the vulnerabilities of the following network protocols: STP, CDP, DTP,
    DHCP, HSRP, IEEE 802.1Q, IEEE 802.1X, ISL (Inter-Switch Link Protocol), and
    VTP (VLAN Trunking Protocol).

    Yersinia supports multithreading: multiple users and multiple attacks per user. It has three
    main modes: command line, network client and ncurses GUI. The attacker can use it to listen
    to the network, sniff packets, edit protocol fields, intercept network data in pcap format,
    analyze captured packets and replay them with the attacker's modifications.

    Yersinia can be used for 29 types of attacks. In STP cases, the MITM attacker may use it on
    computers with two Ethernet cards to disguise as a root role dual-homed switch. In HSRP
    cases, the MITM attacker may use it to become an active router.
    NOTE

     EAP: Extensible Authentication Protocol


     LEAP: Light Extensible Authentication Protocol
     PEAP: Protected Extensible Authentication Protocol
     TTLS: Tunneled Transport Layer Security

    REFERENCE

    1. Whatis.com | SearchSecurity.com Definitions: What is man in the middle attack?


    2. Wikipedia: Man-in-the-middle attack
    3. Javvin Technologies: Network Security Dictionary
    4. Melani | Information Assurance Reporting and Analysis Center: Semi-Annual Report
    2005 Issue 2
    5. Wikipedia: Public-key cryptography
    6. Alberto Ornaghi, Marco Valleri, "Man In The Middle Attacks," BlackHat Conference
    Europe 2003
    7. Sourceforge.net | Ettercap: Short Description
    8. Monkey.org | Dug Song: dsniffx Frequently Asked Questions
    9. Wi-Fi Planet | Tutorials: Deploying 802.1X for WLANs - EAP Types
    10. Wikipedia: One-time password
    11. Information Security Group | Karen Louise Billington and Allan Tomlinson: Mutual
    Authentication of B3G devices within Personal Distributed Environments
    12. Techtarget | Enterprise Desktop Tips: Cheat Sheet - Access Management Solutions
    and Their Pros and Cons
    13. Wikipedia: Extensible Authentication Protocol
    14. Techtarget | Search Security Channel: Common injection attacks
    15. Alberto Ornaghi, Marco Valleri, "Man In The Middle Attacks Demos," BlackHat
    Conference Europe 2003
    16. Wikipedia: Secure Shell
    17. Wikipedia: Extensible Authentication Protocol - EAP-TLS
    18. Packetwatch Research | Ryan Spangler 2003: Packet Sniffing on Layer 2 Switched
    Local Area Networks
    19. Yersinia Home

    You might also like