> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-10-network-sniffing-and-man-in-the-middle-attacks.md). # Topic 10: Network Sniffing and Man-in-the-Middle Attacks ### Simple Explanation Imagine a postman who secretly reads every letter passing through his hands before delivering it — that's **sniffing**. If he also *changes* the letter's content before passing it on, and both the sender and receiver have no idea, that's a **Man-in-the-Middle (MITM) attack**. *** ### 1. What is Network Sniffing? Capturing and analyzing data packets as they travel across a network. A "sniffer" is software/hardware that puts a network card into **promiscuous mode**, allowing it to capture *all* packets on the network segment, not just those addressed to itself. #### Legitimate Uses * Network troubleshooting and performance monitoring (by network admins) * Intrusion detection * Protocol analysis and debugging #### Malicious Uses * Capturing unencrypted credentials, session tokens, sensitive data ### 2. Types of Sniffing | Type | Description | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Passive Sniffing** | Works on networks using a **hub** (which broadcasts all traffic to every port) — attacker just listens, no packets are injected. Rare today since hubs are mostly replaced by switches. | | **Active Sniffing** | Works on **switched** networks (which normally only send traffic to the intended port) — attacker must actively manipulate the network (e.g., ARP spoofing) to redirect traffic to themselves first. | ### 3. How Switches Change the Game * A **hub** broadcasts every packet to every connected device → passive sniffing works easily. * A **switch** learns MAC addresses and sends traffic only to the intended port (using a MAC address table / CAM table) → passive sniffing doesn't work; attacker needs active techniques. ### 4. Active Sniffing Techniques #### A. MAC Flooding * Attacker floods a switch's CAM (Content Addressable Memory) table with a huge number of fake MAC addresses. * Once the table is full, many switches "fail open" — reverting to hub-like behavior, broadcasting all traffic to all ports. * Tool example: `macof`. * **Defense:** Port Security (limiting the number of MAC addresses allowed per switch port). #### B. ARP Spoofing / ARP Poisoning * **ARP (Address Resolution Protocol)** maps IP addresses to MAC addresses on a local network. * ARP has **no authentication** — any device can claim to own any IP address. * Attacker sends forged ARP replies, telling the victim "I am the router" (and telling the router "I am the victim"), positioning themselves in the middle of the traffic flow. * This is the most common technique used to set up a **MITM attack on a local network**. * Tools: `Ettercap`, `Cain & Abel`, `arpspoof`. * **Defense:** Static ARP entries for critical systems, Dynamic ARP Inspection (DAI) on managed switches, ARP monitoring tools (e.g., ArpWatch). #### C. DNS Spoofing / DNS Cache Poisoning * Attacker injects false DNS responses, redirecting a victim's domain lookups to a malicious IP address (e.g., a fake banking site) even though they typed the correct URL. * Often combined with ARP spoofing (attacker is in the traffic path, then intercepts/answers DNS queries with fake responses). * **Defense:** DNSSEC, verifying HTTPS certificates, using trusted/encrypted DNS resolvers (DoH/DoT). #### D. DHCP Starvation and Rogue DHCP * **DHCP Starvation** — attacker floods a DHCP server with fake requests, exhausting the available IP address pool. * **Rogue DHCP Server** — attacker sets up their own DHCP server on the network; if a victim's request reaches it first, the attacker can hand out a malicious gateway/DNS server address, redirecting all the victim's traffic through the attacker. * **Defense:** DHCP snooping on managed switches. #### E. Switch Port Stealing * Attacker floods the network with forged ARP/Ethernet frames using the target's MAC address as the source, tricking the switch into associating the victim's MAC with the attacker's port temporarily. ### 5. Man-in-the-Middle (MITM) Attacks — General Concept An attacker secretly positions themselves between two communicating parties, able to intercept, read, and potentially alter the traffic — while both parties believe they're communicating directly with each other. #### Common MITM Setup Methods * ARP Spoofing (local network) * Rogue Wi-Fi Access Points (evil twin — covered in Wireless Security topic) * DNS Spoofing * Session Hijacking (covered in its own Module 2 topic) * SSL Stripping — downgrading an HTTPS connection to unencrypted HTTP so traffic can be read (relies on the victim not noticing the missing padlock icon) ### 6. Packet Sniffing Tools | Tool | Purpose | | --------------- | ------------------------------------------------------------------------------------------------------ | | **Wireshark** | The industry-standard GUI packet analyzer — captures and deeply inspects traffic, protocol by protocol | | **tcpdump** | Command-line packet capture tool (Linux) | | **Ettercap** | Combines ARP spoofing + sniffing + MITM attack framework | | **Cain & Abel** | Windows tool for sniffing, ARP poisoning, password recovery (older tool, still referenced in theory) | | **dsniff** | Suite of tools for network auditing/penetration testing including sniffing | | **Bettercap** | Modern, powerful MITM framework | ### 7. What Sniffing Can Reveal (if traffic isn't encrypted) * Plaintext login credentials (old protocols like Telnet, FTP, HTTP forms without HTTPS) * Session cookies/tokens * Emails sent over unencrypted protocols * File transfers * DNS queries (reveals browsing habits) **This is exactly why encryption (HTTPS, SSH, VPNs) matters — even if traffic is sniffed, it should be unreadable.** ### 8. Detecting Sniffers on a Network * Checking if a network interface is in **promiscuous mode** (tools like `ifconfig`/`ip link` on Linux can show this, or dedicated detection tools). * **ARP-based detection** — sending ARP requests to a suspected IP with a wrong MAC and seeing if it still responds (a sniffer might respond because it's not filtering by MAC properly) — used by tools like ARP Watch. * **Latency-based detection** — sniffing software can slightly slow down a host's response times under specific ping tests. * Network monitoring for unusual ARP table changes. ### 9. Countermeasures Against Sniffing and MITM * **Use encryption everywhere** — HTTPS (not HTTP), SSH (not Telnet), SFTP/FTPS (not FTP), VPNs for remote access. * **Use switches with Port Security** — limit MAC addresses per port, disable unused ports. * **Dynamic ARP Inspection (DAI)** and **DHCP Snooping** on managed switches. * **Static ARP entries** for critical infrastructure (routers, servers). * **VLAN segmentation** to limit the broadcast domain and reduce sniffing scope. * **Certificate pinning / strict HTTPS enforcement (HSTS)** to prevent SSL stripping. * **Network monitoring/IDS** to detect ARP anomalies and rogue DHCP servers. * **VPNs** on public/untrusted networks (like public Wi-Fi) to encrypt all traffic end-to-end. ### Practical / Lab Notes * Capture traffic with `tcpdump -i eth0` or Wireshark on your own lab VM network. * In Wireshark, use display filters like `http.request`, `arp`, or `dns` to isolate specific traffic types. * Practice identifying ARP spoofing by watching for duplicate/changing MAC-to-IP mappings in captured ARP traffic. * (Always perform sniffing/ARP-spoofing exercises only inside your own isolated lab network — never on shared or production networks without explicit authorization.) *** ### Exam Points (Quick Revision) * Sniffing = capturing packets; needs promiscuous mode. * Passive sniffing works on hubs; Active sniffing needed on switches. * ARP has no authentication → ARP Spoofing is the classic way to set up a local MITM. * MAC Flooding overflows the switch CAM table, forcing hub-like broadcast behavior. * DNS Spoofing redirects victims to fake sites even with correct URL typed. * SSL Stripping downgrades HTTPS → HTTP to read traffic. * Tools: Wireshark (analysis), Ettercap/Bettercap (MITM framework), tcpdump (CLI capture). * Best defense = encryption everywhere (HTTPS/SSH/VPN) + Dynamic ARP Inspection + DHCP Snooping + Port Security. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-10-network-sniffing-and-man-in-the-middle-attacks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.