UNDERCODE COMMUNITY

TONS OF HACKERS BOOKS:

http://index-of.es/

284 views18:11

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑how do you intercept traffic?
How to position and set up listening equipment?

I propose to consider options for the location (connection) of equipment for sniffing in a switched environment (we will consider intercepting a wi-fi channel in the next article).
The most convenient way is to install a sniffer directly on the listening host of interest to us.

However, some of the traffic that is very useful for research, but not intended for the end device, will be discarded by the network interface and not sent for processing to the system, and therefore we will not be able to capture this traffic for further research. This traffic includes broadcast traffic within the operation of the switch.

For example, an ARP request that hosts use to determine the MAC address that corresponds to a specific IP address.

1) Knowing the IP, we send an ARP request in order to match the IP-MAC to all devices within the broadcast domain.

2) However, only the target host is “interested” in receiving such a request; other hosts, as mentioned above, will discard the specified packet.

For clarity, using the Cisco Packet racer, consider how a host with IP address 192.168.1.2 sends an ARP request to host 192.168.1.4.

3) Having previously checked that there are no ARP entries on 192.168.1.2 from the word at all with the command arp -a (you can delete them using arp -d), we execute the ping command on 192.168.1.4.

4) Since we do not know the MAC address, we first send an ARP request. The request comes to the switch (cisco 2960), then it is sent to all hosts connected to the switch. After that, host 192.168.1.3 discards the specified one, and 192.168.1.4 responds accordingly.

5) In order to capture all incoming traffic on 192.168.1.3, you need to enable mixed mode of operation on the network interface . The software components Aircrack-ng, Wireshark, tcp dump, etc. allow you to do this.

6) When it is not possible to place a traffic analyzer on the target host , a hub can help .

In this case, the host under investigation and the traffic analyzer in the same switched network segment are connected to the same hub.

As a result, all incoming and outgoing packets will pass through all ports of the hub.

7) For example, by sending packets from Host1 to Host2, Hub0 will send them to both the Host2 under investigation and the Sniffer packet sniffer.

Dropping packets by the Sniffer in the picture is due to the disabled mixed mode of the network adapter

8) Port mirroring remains the most popular way to intercept traffic .

To implement this method, the switch must be manageable, and also have physical or via a remote ssh / Web interface access to it.

The point is that the incoming and outgoing traffic of the device connected to the switch port is mirrored to another switch port where the traffic analyzer is connected.

9) So, having connected, we configure the Cisco 2960 switch to mirror traffic on the fastEthernet 0/1 and fastEthernet 0/2 ports where host1 and host2 are connected, respectively:

Switch> enable
Switch # conf terminal
Switch (config) #monitor session 1 source interface fastEthernet 0/1
Switch (config) #monitor session 1 source interface fastEthernet 0/2
And the port to which the traffic will be mirrored, where the packet analyzer is connected:

Switch (config) #monitor session 1 destination interface f0 / 24
Let's check:

Switch # show monitor

don't clone our tutorials :)
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

367 views19:26