From: Chayah Fox (csf@CBORD.com)
Date: Mon Oct 03 2005 - 14:40:53 EDT
Kyle there is a wonderful utility that makes all of that very easy to
do. Its called Cain and Able from oxidit. It interfaces well with
rainbow crack, which if you have already generated all of the tables can
be very quick in cracking most hashes.
Chayah Fox
Support Technician
CBORD Group, Inc.
61 Brown Road
Ithaca,NY14850
T: 607.257.3775 x2273
F: 607.257.1902
csf@cbord.com
www.cbord.com
-----Original Message-----
From: Kyle Starkey [mailto:kstarkey@siegeworks.com]
Sent: Friday, September 30, 2005 2:33 PM
To: pen-test@securityfocus.com
Subject: ARP Spoofing and Routing
Folks..
I was on site yesterday at a client doing some pen-test type work and
thought I might play around with some arpspoofing and see what I could
gather. I ran into a couple of problem and thought you all might have
the solution.
What I was trying to do was arpspoof a server so that I could intercept
any authentication requests that were made to it and grab passwds or
hashes to find some user accts. I was using the Auditors Toolkit
bootable CD and the arpspoof worked great. A tcpdump of the eth0 int
when the spoof started showed that I was getting all the traffic that
should have been destined for this server (hosts and server and myself
were all in the same bcast seg btw). However I was not running any
deamons (ftp, samba, telnet, etc) to answer these requests and as such
was only seeing part of the conversation and couldn't complete the
connection to get the full auth request. So what I need to know is how
I go about sending packets that were destined for the server originally
to the actual server after I have had my tcpdump/dsniff/etc doing the
packet capture and filter. My ideas are as follows and I could use some
responses about them or OTHER ways I can accomplish this...
1) routed routing traffic to the original host with a static ARP entry
in my host for the server I am spoofing so I don't spoof myself
2) some kind of proxy server that will capture and forward traffic based
on the dest addr of the packet and again a static arp entry for the host
being spoofed so we don't spoof ourselves
3) load ftpd, samba, telnet, to answer these requests, even if we are
denying auth people will still pass user credentials in an attempt to
login, after the arpspoof has happened...
4) some other already built tool that I have never heard of and should
learn to use...
If this makes no sense please feel free to flame me and call me an
idiot, but its been a long week and the coffee aint helping...
-K
Kyle R. Starkey
Senior Security Consultant
CISSP # 31718
Siegeworks LLC
Email: kstarkey@siegeworks.com
Cell: 435-962-8986
------------------------------------------------------------------------
------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on
your website. Up to 75% of cyber attacks are launched on shopping carts,
forms, login pages, dynamic content etc. Firewalls, SSL and locked-down
servers are futile against web application hacking. Check your website
for vulnerabilities to SQL injection, Cross site scripting and other web
attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
------------------------------------------------------------------------
-------
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:01 EDT