From: Adrian Lazar (alazar@node.bc.ca)
Date: Fri Apr 05 2002 - 12:59:58 EST
Visit the following sites for more information:
http://www.sans.org/newlook/resources/IDFAQ/switched_network.htm
http://www.monkey.org/~dugsong/dsniff/faq.html#How%20do%20I%20sniff%20in
%20a%20switched%20environment
Two useful tools that you can use: dsniff and ettercap.
Hope this helps.
Cheers,
Adrian Lazar
Chief Security Officer (CSO)
Node Solutions, Inc.
(604) 821-1696
-----Original Message-----
From: Erlend J. Leiknes [mailto:nookie@online.no]
Sent: Tuesday, February 05, 2002 11:01 AM
To: pen-test@securityfocus.com
Subject: arpspoofing
Im testing a network for clear-text password leakage. (Unencrypted
protocols)
Since its a switched enviorment I have to arpspoof or macflood.
Macflooding had no success, shouldnt the switches be degraded to hubs
when
their mac-tables get filled?
And when I arpspoof using the redirecting data from the gateway to the
laptop, pings wont get through, and i sent some clear text on purpose
from
machines that had gotten their arp table poisoned. Still it seemed like
it
didnt work too well.
The question is:
if arp -a (on windows 98) shows:
Interface: x.x.x.204 --- 0x2
Internet Address Physical Address Type
x.x.x.1 00-10-14-26-60-38 dynamic
x.x.x.5 00-50-da-37-93-5b dynamic
x.x.x.6 00-50-da-37-93-5b dynamic
who will recive the packages. 5, 6 or both?
Any other ways to sniff in a switched enviorment?
------------------------------------------------------------------------
---- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/ ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:20 EDT