From: Tim (tim-pentest@sentinelchicken.org)
Date: Thu Oct 25 2007 - 12:36:49 EDT
Hello,
> Well you could poison one's cache but without you having an ip address it
> will be pointless. Arp is used to map l2 to l3. So if you send rogue
Actually... isn't it supposed to map L3 to L2? This is probably an
important distinction here.
> packets saying that mac 11:22:33:44:55:66 is on your ip address without you
> having one the hosts will start sending packets to the rogue ip address (
> that should be yours) and because you don't have it setup the traffic will
> go to /dev/null ( the switches will forward it to you nic but you won't
> have an ip address and the kernel will most likely discard it). I think
> this is what will happen. And ARP is designed to find an address based on
> another one.
If we falsely advertize that a given IP address maps to our NIC address,
then the switch should send those packets to that NIC regardless of
whether or not we have an IP, right? Sure, the kernel will discard
those packets but that shouldn't matter if we're listening on the raw
device in promiscuous mode. So, in theory it should be possible, though
please correct me if my understanding is flawed.
Now the applicable questions are: Does Linux lets you go into
promiscuous mode while you're bridging? Does Linux let you send false
ARP packets on an interface that's bridging?
The former question I would guess is a yes. If not, you could at a
minimum use iptables in bridging mode to redirect some packets to some
place where you can more easily sniff them.
The latter question I'm not sure on, but even if there were a kernel
limitation on that, you could poison the switch from another interface
or system.
HTH,
tim
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:58:11 EDT