Re: MAC address spoofing - conflict?

[Cedric Blancher <blancher () cartel-securite fr>]

Le mercredi 16 août 2006 à 10:26 +0200, Lubos Kolouch a écrit :
> I think it does matter. Because there will be more than host replying to
> ARP broadcasts and the question is what will happen.

Nope it does not matter, because you won't have multiple answers...

ARP asks for an _IP_ address, not a MAC one. Therefore, if MAC addresses
are identical, but IP addresses are different, an ARP request for one
given IP address will get one answer only. In the end, you will end up
with two entries in ARP cache with the same MAC address, but there's not
problem out there.

And if, in case of some wierd and unexplained behaviour (aka awful bug),
both hosts were replying, they would reply with the same MAC address to
the same request, so you would not have problem either.

Le jeudi 17 août 2006 à 01:03 +0000, penetrationtestmail () gmail com a
écrit : 
> And if anyone knows the exact answer, that would be most helpful ;)

The exact answer is: you can seamless spoof MAC addresses on WLAN as
long as you use a different IP address than spoofed host, so you don't
have TCP RST problems and stuff like this. Tested in lab and real life
for pentests.

It's a classical technic (among others[1]) for bypassing some cheap, but
still widespread, WLAN captive portal that only track authenticated
clients with their MAC address.


[1] http://sid.rstack.org/pres/0602_ESW_CaptiveBypass.pdf

-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
> > Hi! I'm your friendly neighbourhood signature virus.
> > Copy me to your signature file and help me spread!

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------