frostbits-security/mitm-cheatsheetCheatsheet cataloging man-in-the-middle attacks across L2-L4 and wireless layers, with attack tools, detection methods, and mitigation techniques for pentesters and defenders.
We tried to put together all known MITM attacks and methods of protection against these attacks. Here is also contains tools for carrying out MITM attacks, some interesting attack cases and some tricks associated with them.
Note: Almost all attack tools, described here, doesn't have any sniffer inside. It only provides attack. Tools for sniffing here: Data sniffing.
A cheat sheet for pentesters and defensive teams about Man In The Middle attacks.
⏳ - part in process
Сomplexity: Low
Relevance: High
Description:
Address Resolution Protocol (ARP) designed for resolving IP addresses to MAC addresses. All network devices that need to communicate in the network use broadcast ARP queries to find out other machines’ MAC addresses.
Almost all arp spoofing tools use a gratuitous arp response. A Gratuitous ARP reply is a reply to without a ARP request.
Despite the effectiveness of gratuitous ARP, it is particularly insecure because it can be used to assure the remote host that the MAC address of a system on the same network has changed and to specify which address is used now.
Before ARP-spoofing is performed, there are entries in the ARP tables of nodes A and B with IP and MAC addresses of each other. The information is transmitted between nodes A and B.
During the ARP-spoofing process, the С computer performing the attack sends ARP responses (without receiving requests = gratuitous arp) =>
Also there is a chance of successful attack in another way. When you will monitor the arp activity in the network segment and suddenly notice the victim's arp request, you can try send the arp reply to victim faster than addressee of that request. Some vendors can accept this trick.
Attack tools:
bettercap -T 10.10.10.10 -X --httpd --proxy-https --proxyarpspoof -i eth0 -t 10.10.10.10Attack detection
Attack prevention
Manual ARP tables
It has limitation because it will cause difficulties in network scalability. And for wireless network this is a challenge and almost like impossible.
Patching
Utilities such as Anticap and Antidote can play a vital role in preventing ARP spoofing where Anticap prevent updating the ARP cache with different MAC with the existing ARP cache which actually prevent the ARP spoofing but it violates the ARP protocol specification which indeed a problem where on the other hand Antidote prevents the ARP poisoning slightly different way. It analyzes the newly received ARP reply with the existing cache. If the new cache differs with the previous then it look for the MAC address if it still alive. If it found the previous cache MAC address alive, rejects the new one and it adds the attacker MAC address in the list of banned MAC address to prevent further attempts from the ARP poisoning on the same target computer.
Creating a VLAN on the switch
A VLAN is created on the switch that contains only the switch itself and a specific network device.
Creating encrypted connections
This method is also suitable for public networks, because all traffic is encrypted and it is impossible to intercept any user data.
DAI
Dynamic ARP inspection in cisco systems helps prevent the man-in-the-middle attacks by not relaying invalid or gratuitous ARP replies out to other ports in the same VLAN. Dynamic ARP inspection intercepts all ARP requests and all replies on the untrusted ports. Each intercepted packet is verified for valid IP-to-MAC bindings via DHCP snooping. Denied ARP packets are either dropped or logged by the switch for auditing so ARP poisoning attacks are stopped. Incoming ARP packets on the trusted ports are not inspected.
Related links
How ARP works
Сomplexity: High
Relevance: Moderate
Description:
The spanning tree protocol is designed to detect and prevent loops in the network if there are redundant paths between the switches.
Anyone who can emulate a device with a (lower) root switch identifier (by connecting a new virtual device with a lower priority or using the STP packet generation tool) can partially or completely intercept the virtual network traffic. Typically, an attacker does not have a physical connection with two switches, so the described attack method is hardly possible. However, in wireless networks, the situation is changing, since the cable connection (socket in the office) and the wireless connection (access point) can end on different switches.
Attack tools
Caution: Often this type of attack leads to a denial of service.