CMU6XX

Ethical Hacking

Session 6: Sniffing & MITM Attacks

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct Layer 2 network communication and the Address Resolution Protocol (ARP).
  • Execute ARP Poisoning to establish a Man-in-the-Middle (MITM) position.
  • Analyze packet captures (.pcap) using Wireshark to extract credentials.
  • Analyze SSL Stripping attacks and downgrade vulnerabilities.
  • Evaluate the security implications of rogue access points (Evil Twins).

Seminar Structure (3 Hours)

Part 1: Layer 2 Exploitation & Packet Analysis (1.5 hrs)
  • Hubs, Switches, and Promiscuous Mode
  • The ARP Protocol & ARP Poisoning
  • Task 1: Wireshark Packet Analysis
Part 2: Intercepting Encrypted Traffic (1.5 hrs)
  • SSL Stripping & Downgrade Attacks
  • DNS Spoofing & Rogue Access Points
  • Task 2: MITM Simulation & HSTS Analysis

Part 1: Layer 2 Exploitation & Packet Analysis

Duration: 1.5 Hours

Network Sniffing Fundamentals

Network Interface Cards (NICs) normally ignore packets not addressed to their specific MAC address.

  • Promiscuous Mode: Configuring the NIC to pass all traffic it sees up to the CPU for analysis (e.g., using tcpdump or Wireshark).
  • The Hub Problem: In legacy networks using Hubs, all packets are broadcast to all ports. Sniffing requires zero effort.
  • The Switch Solution: Switches map MAC addresses to physical ports and only send traffic to the intended recipient. To sniff on a switched network, an attacker must force traffic through their machine (MITM).

Address Resolution Protocol (ARP)

ARP translates IP addresses (Layer 3) to MAC addresses (Layer 2) on a local network.

The Flaw: ARP is stateless and has no authentication mechanism.

  • When a machine asks "Who has IP 192.168.1.1 (the router)?", any machine can reply "I do! My MAC address is AB:CD."
  • Furthermore, machines will accept unsolicited ARP replies (Gratuitous ARP) and update their internal ARP cache.

ARP Poisoning (Spoofing)

The standard method for establishing a MITM position on a local switched network.

  1. The attacker sends forged ARP replies to the Victim, saying "I am the Router."
  2. The attacker sends forged ARP replies to the Router, saying "I am the Victim."
  3. The switch updates its MAC tables. Now, all traffic between the Victim and the Internet flows directly through the Attacker's machine.
The attacker must enable "IP Forwarding" on their machine, otherwise the traffic drops and the victim loses internet access (a DoS instead of a MITM).

Introduction to Task 1

Once you are in the middle, you must make sense of the millions of packets flowing across the wire using protocol analyzers like Wireshark.

We will analyze a packet capture to extract cleartext credentials from an insecure protocol.

Task 1: Wireshark Packet Analysis

Timing: 45 minutes

You have intercepted traffic on the network and saved it as capture.pcapng. You suspect a user logged into a legacy FTP server.

  1. Open the file in Wireshark. Write the exact Display Filter required to show only FTP traffic containing authentication attempts.
  2. Right-click the relevant packet and use "Follow TCP Stream".
  3. Extract the username and password from the cleartext stream.
  4. Discuss the architectural difference between FTP and SFTP in mitigating this attack.
Practical Resource: Wireshark Display Filter Reference

15 Minute Break

Please return promptly for Part 2.

Part 2: Intercepting Encrypted Traffic

Duration: 1.5 Hours

The Problem with HTTPS

If the victim is visiting an HTTPS website, intercepting the traffic via ARP poisoning only yields encrypted gibberish.

  • If the attacker tries to present their own SSL certificate to decrypt the traffic, the victim's browser will throw a massive red "Invalid Certificate" warning.
  • To steal data, the attacker must either trick the user into ignoring the warning, or prevent the HTTPS connection from establishing in the first place.

SSL Stripping (Downgrade Attacks)

Invented by Moxie Marlinspike, this attack targets the moment a user types bank.com without specifying https://.

  1. Victim sends unencrypted HTTP request for bank.com.
  2. Attacker intercepts the request and connects to the real bank via HTTPS on behalf of the victim.
  3. Attacker receives the HTTPS response, strips out the encryption, changes all https:// links to http://, and forwards the unencrypted page to the victim.
  4. The victim logs into an HTTP page, and the attacker captures the cleartext credentials.

Alternative Interception

  • DNS Spoofing: The attacker intercepts DNS requests on the local network. When the victim asks for the IP of google.com, the attacker replies with the IP of their malicious phishing server.
  • Evil Twin Access Points: Setting up a rogue Wi-Fi router with the exact same SSID (e.g., "Starbucks_WiFi") as the legitimate network, but with a stronger signal. Victims auto-connect to the attacker, providing an instant MITM position without needing ARP poisoning.

Introduction to Task 2

SSL Stripping was incredibly effective for years, forcing the industry to create a robust architectural defense mechanism built directly into modern browsers.

We will simulate an ARP Poisoning attack and examine the impact of HTTP Strict Transport Security (HSTS).

Task 2: MITM Simulation & HSTS Analysis

Timing: 50 minutes

You have Kali Linux and a target Windows VM on the same virtual subnet.

  1. Draft the exact arpspoof commands required to establish a two-way MITM position between the Windows VM and the gateway.
  2. Assume you launch sslstrip. The victim attempts to navigate to http://facebook.com. The attack fails, and the browser forces an HTTPS connection anyway.
  3. Explain the mechanism of HSTS (HTTP Strict Transport Security) and how the "HSTS Preload List" fundamentally breaks the SSL Stripping attack methodology.
Practical Resource: HSTS Preload List Submission

Summary & Next Steps

  • Local networks are inherently trusting. Protocols like ARP prioritize availability over confidentiality and integrity.
  • Encryption in transit (HTTPS/TLS) is the ultimate defense against MITM, provided downgrade attacks (HSTS) and certificate warnings are strictly enforced.
Next Week: Social Engineering (Human Vulnerabilities)