SNIFFING Gif3

SNIFFING
WHAT IS SNIFFING?
Sniffing is the act of intercepting and monitoring traffic on a network. This can be done using
software that captures all data packets passing through a given network interface or by using
hardware devices explicitly designed for this purpose.
SNIFFER
“A sniffer is an application or device that can read, monitor, and capture network data
exchanges and read network packets”. Some consider sniffing as the most common type of
passive attack on networks. A sniffer can provide a full view of data inside a packet if the
packets are not encrypted. Sniffing programs come in the form of either commercial packet
sniffers used to help maintain networks or underground packet sniffers used to break into
computers.
An attacker using a sniffer can read a network’s communications and analyze it to gain
information to eventually cause the network to crash or even become corrupted. Vulnerable
protocols that are often sniffed, especially for passwords, include telnet, ftp, POP…..etc (see
figure 1)
WHAT IS SNIFFING ATTACKS?
A sniffing attack occurs when an attacker uses a packet sniffer to intercept and read sensitive
data passing through a network. Common targets for these attacks include unencrypted email
messages, login credentials, and financial information.
In some cases, attackers may also use sniffing attack tools and packet sniffers to inject
malicious code into otherwise innocuous data packets in an attempt to hijack a target’s
computer or other devices.
HOW DO HACKERS INTERCEPT PACKETS?
There are several ways an attacker can capture packets passing through a network. One
popular method is to set up a packet sniffer on a computer connected to the network in
question. This computer acts as a proxy between the targeted devices and the rest of the
world, allowing the attacker to capture all traffic passing through.
Another common technique is ARP poisoning, in which the attacker tricks devices on the
network into thinking they are communicating with another device when they are not
(Grimmick, 2021). This allows the attacker to intercept and read all traffic passing between
the two “devices.”
CONSEQUENCES OF A SNIFFING ATTACK
A successful sniffing attack can have several severe consequences for the targets. These can
include:
 Loss of sensitive data, such as login credentials, financial information, and email messages
 Injection of malicious code into target systems, allowing attackers to control devices or
access sensitive information
 Interruption of network traffic, which can cause communication problems and slow down
network performance
 Exposure of confidential information, such as trade secrets and proprietary data
 Damage to the reputation of the organization whose network has been compromised
HOW CAN SNIFFING ATTACKS BE PREVENTED?
There are many ways to protect your network against sniffing attacks. Some key measures
include:
 Using encryption to protect sensitive data from being intercepted
 Never sending sensitive information over an unencrypted connection
 Ensuring that all computers on a network are adequately protected with antivirus and
firewall software
 Making sure the wireless network is secured using WPA or WEP encryption
 Regularly updating all software and devices with the latest security patches
 Staying aware of what type of traffic passes through the network and taking steps to
protect sensitive information
 Using a VPN when connecting to public Wi-Fi networks
 Continuously monitoring the network for unusual activity
TYPES OF SNIFFING ATTACKS
There are two primary sniffing attack types: active and passive
ACTIVE SNIFFING ATTACKS
Active sniffing attacks majorly refer to attacks triggered by injecting Address Resolution
Protocols (ARPs) into a network to flood the Switch Content address memory (CAM) table.
The redirected legitimate traffic finally allows the attacker to perform the sniffing of the traffic
from the switch.
In this sniffing type, attacker directly interacts with target machine by sending packets and
receiving responses.
• This sniffing is carried out through Switch. In this type, attacker tries to poison the switch
by sending bogus MAC address.
• Examples of active sniffing: ARP spoofing, MAC flooding, HTTPS and SSH spoofing,
DNS spoofing etc.
PASSIVE SNIFFING ATTACKS
This kind of sniffing usually occurs at the hub. Contrary to active sniffing, here the hub can be
directly injected with a sniffing device to easily extract the data packets. However, hubs hardly
are used these days and hence passive sniffing attacks are barely reported.
In this sniffing type, attacker does not interact with the target. He/she simply hook on to the
network and captures packets transmitted and received by the network or exchanged between
two machines.
• This sniffing is carried out through hub. An attacker connects to the hub from his/her
machine. Attacker needs account on the LAN.
• Examples of passive sniffing: Hub based networks or wireless networks
THERE ARE VARIOUS TYPES OF SNIFFING ATTACKS SUCH AS
 LAN Sniff – The sniffer attacks the internal LAN and scans the entire IP gaining access
to live hosts, open ports, server inventory, etc. A port-specific vulnerability attack
happens in LAN sniffing.
 Protocol Sniff – The sniffer attacks occur based on the network protocol used. Different
protocols such as ICMP, UDP, Telnet, PPP, DNS, etc., or other protocols might be used.
 ARP Sniff – ARP Poisoning attacks or packet spoofing attacks occur based on the data
captured to create a map of IP addresses and associated MAC addresses.
 TCP Session stealing – TCP session stealing is used to monitor and acquire traffic
details between the source & destination IP address. All details such as port number,
service type, TCP sequence numbers, data are stolen by the hackers.
 Application-level sniffing – Applications running on the server are attacked to plan an
application-specific attack.
 Web password sniffing – HTTP sessions created by users are stolen by sniffers to get
the user ID, password, and other sensitive information.
Exercises
1- When does a masquerade take place and when does it attack?
2- Why these four categories: masquerade, replay, modification of messages, and denial
of service described as active attack rather than passive attack?
3- What does Modification of messages simply mean?
4- What is a sniffer?
5- What does DNS stand for? And what does it do?
6- What does ARP stand for?
7- What does MAC stand for? And what does MAC Spoofing do?

SNIFFING Gif3

Uploaded by

Copyright:

Available Formats

SNIFFING Gif3

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SNIFFING Gif3

Uploaded by

Copyright:

Available Formats

SNIFFING

CONSEQUENCES OF A SNIFFING ATTACK

HOW CAN SNIFFING ATTACKS BE PREVENTED?

ACTIVE SNIFFING ATTACKS

PASSIVE SNIFFING ATTACKS

THERE ARE VARIOUS TYPES OF SNIFFING ATTACKS SUCH AS

You might also like