Penetration Testing mailing list archives
RE: Wired captive portal pen-test
From: "Sergio Castro" <sergio.castro () unicin net>
Date: Wed, 16 Jul 2008 19:23:44 -0500
What I mean is that if he's not seeing ARP requests, it means there's a switch-router there, and not a hub. As to MITM, if the switch-router is FULLY secured, it is correct, you cannot launch such attack. But if it has a standard, medium security configuration, such attacks are possible; I do them all the time. But that's why I said that he MAY be able to do it, not that he CAN do it :) Regards, - Sergio -----Mensaje original----- De: listbounce () securityfocus com [mailto:listbounce () securityfocus com] En nombre de "Jos?é M. Palazón Romero" Enviado el: Miércoles, 16 de Julio de 2008 03:28 a.m. CC: pen-test () securityfocus com Asunto: Re: Wired captive portal pen-test Sergio Castro escribió:
So yes, if you only see broadcast ARP requests from the router, the switch is very likely securely configured.
This is incorrect, Sergio. ARP replies are not broadcast, so it's perfectly ok that he doesn't see them.
Did you try using Cain? You may be able to do ARP poisoning with it and intercept traffic between the router and IPs in your same subdomain.
If the switch were secured, then this wouldn't work either. Not even an ARP spoofing would work. The only option would be to find a flaw in the switch firmware or to trick it in such a way that, as most switches do, that it doesn't know how to behave anymore, and it starts acting as a hub. But it's unlikely that you find this in any modern switch. Have you tried to atack the switch itself? Try the firsts and the lasts IPs in your network. If the switch is advanced enough to filter that way, then it has a way to setup that, and probably that's a web interface. Try also uPNP. It's no authenticated, so if it's enabled, is your lucky day. Anyway, I still think they are probably not filtering at layer 2. Palako
- Sergio -----Mensaje original----- De: Roman Medina-Heigl Hernandez [mailto:roman () rs-labs com] Enviado el: Lunes, 14 de Julio de 2008 02:34 p.m. Para: Sergio Castro CC: pen-test () securityfocus com Asunto: Re: Wired captive portal pen-test Sergio Castro escribió:I've done similar voipsec audits at hotels. The hotel is very likely using a switch-router (and very likely VLANs) so you will not be able to see any other IPs on the network. What is your sniffer showing?I saw ARP requests coming from the router and asking for the MAC of several other IPs of the same segment where my laptop was connected (in my case, 192.168.9.x). I didn't catch any ARP responses... Another probe I did was walking to a "public computer" in the hotel (some kind of internet-kiosk) and get the IP. The IP was in the same 192.168.9.x range. I didn't have time to get its MAC and try to configure my laptop's NIC with that MAC (although the switch should
probably stop that...
shouldn't it?).Another possible attack vector you may use is their IP phones. If the room has an IP phone, try connecting your laptop to the phone's RJ45 and do a packet sniff. I've been able to access entire corporate LANsdoing this. I didn't have a look at this... although I'd guess it was rj-11... Next time I'll check it! :)
------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------ __________ NOD32 3274 (20080716) Information __________ This message was checked by NOD32 antivirus system. http://www.eset.com ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------
Current thread:
- Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 14)
- Re: Wired captive portal pen-test Mike Hale (Jul 14)
- Re: Wired captive portal pen-test Terry Cutler (Jul 14)
- RE: Wired captive portal pen-test Sergio Castro (Jul 14)
- Re: Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 14)
- RE: Wired captive portal pen-test Sergio Castro (Jul 14)
- Re: Wired captive portal pen-test José M. Palazón Romero (Jul 16)
- Re: Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 16)
- RE: Wired captive portal pen-test Sergio Castro (Jul 16)
- Re: Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 14)
- Re: Wired captive portal pen-test José M. Palazón Romero (Jul 15)
- Re: Wired captive portal pen-test Mario Spinthiras (Jul 16)
- Re: Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 16)
- Re: Wired captive portal pen-test Mike Hale (Jul 14)
- Re: Wired captive portal pen-test Roman Medina-Heigl Hernandez (Jul 16)
- Re: Wired captive portal pen-test Mario Spinthiras (Jul 17)