Como o envenenamento ARP funciona se o endereço IP estiver errado?
É normalmente chamado de ARP Spoofing, mas também conhecido como ARP Poison Routing (APR) ou envenenamento por cache ARP.
ARP Poisoning doesn't change the IP destination in the table so why does spoofing the MAC under another IP address help to redirect the traffic?
-
Hubs, Switches e o lado Lan dos dados de rota do roteador usando o endereço MAC contido no frame de dados Ethernet.
-
Durante o ataque, as entradas da tabela ARP para o endereço IP da vítima conterão o endereço MAC do invasor.
-
Quando qualquer dado for enviado para ou a partir do endereço IP da vítima, ele será roteado para o endereço MAC do invasor.
The goal of ARP poisoning is to send an unsolicited message to 'overwrites' the host's & router's ARP table so that the MitM attacker's MAC address is associated with both.
Não, isso não está correto.
- As entradas da tabela ARP para o endereço IP da vítima conterão o endereço MAC do invasor.
- As entradas da tabela ARP para o IP do roteador não são alteradas.
- O invasor pode optar por encaminhar o tráfego do endereço IP da vítima para o roteador, mas não precisa fazê-lo.
Veja abaixo O que acontece próximo para mais informações.
O que é ARP Spoofing?
ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network.
Once the attacker’s MAC address is connected to an authentic IP address, the attacker will begin receiving any data that is intended for that IP address.
ARP spoofing can enable malicious parties to intercept, modify or even stop data in-transit. ARP spoofing attacks can only occur on local area networks that utilize the Address Resolution Protocol.
Veracode da fonte ARP Spoofing
Como isso funciona?
ARP spoofing attacks typically follow a similar progression. The steps to an ARP spoofing attack usually include:
The attacker opens an ARP spoofing tool and sets the tool’s IP address to match the IP subnet of a target. Examples of popular ARP spoofing software include Arpspoof, Cain & Abel, Arpoison and Ettercap.
The attacker uses the ARP spoofing tool to scan for the IP and MAC addresses of hosts in the target’s subnet.
The attacker chooses its target and begins sending ARP packets across the LAN that contain the attacker’s MAC address and the target’s IP address.
As other hosts on the LAN cache the spoofed ARP packets, data that those hosts send to the victim will go to the attacker instead. From here, the attacker can steal data or launch a more sophisticated follow-up attack.
Veracode da fonte ARP Spoofing
O que acontece depois?
The attacker may choose to inspect the packets (spying), while forwarding the traffic to the actual default gateway to avoid discovery, modify the data before forwarding it (man-in-the-middle attack), or launch a denial-of-service attack by causing some or all of the packets on the network to be dropped.
Fonte Wikipedia ARP spoofing