Re: PPPoE sniffing

[LordDoskias <lorddoskias () gmail com>]

derk dork wrote:
> */LordDoskias <lorddoskias () gmail com>/* wrote:
>
>     dork_4love () yahoo com wrote:
>     > Greetings,
>     >
>     > I am working in cooperate with friend running an ISP ,my friend
>     >
>     > installed PPPoE ,by that he says that it will be immune to
>     packet sniffing
>     >
>     > -My question:
>     >
>     > --Is it possible to run the usual arp spoofing ,sniffing,ssl mitm on
>     >
>     > PPPoE installed networks?
>     >
>     > --And if that feasible does ettercap is capable of doing such
>     duty? or
>     >
>     > there are other tools to test that?
>     >
>     >
>     > Regards,
>     >
>     > Bernard
>     >
>     >
>     ------------------------------------------------------------------------
>     > This list is sponsored by: Cenzic
>     >
>     > Need to secure your web apps NOW?
>     > Cenzic finds more, "real" vulnerabilities fast.
>     > Click to try it, buy it or download a solution FREE today!
>     >
>     > http://www.cenzic.com/downloads
>     >
>     ------------------------------------------------------------------------
>     >
>     >
>     >
>     There is no problem sniffing the pppoe packets if you arp poison the
>     network - the thing is whether your friend uses CHAP/PAP or something
>     else for encrypting the passwords between the peer and the
>     concentrator
>
> He is using CHAP.
> The other question if someone managed to get certain password can he 
> sniff certain tunnel b/t the two peers.
> Thanx inforward,
> Regards,
> Bernard
>
> ------------------------------------------------------------------------
> Never miss a thing. Make Yahoo your homepage. 
> <http://us.rd.yahoo.com/evt=51438/*http://www.yahoo.com/r/hs> 
Well, with CHAP if you sniff the whole challenge you could run a 
bruteforce program to try and crack the password. And also - if you 
don't use encryption for the tunnel e.g. MPPE if you do an ARP attack 
you could sniff the pppoe frames and see the traffic in it. I'm not sure 
about it, though. But common logic suggests that.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------