�ݺ�ߣ

Editor's Notes

• #3: if you need notes for this slide, you suck.
• #4: there’s alice and bob they want to talk to each other. because they’re friends. mallory hates them both. she’s got a plan. if she can jump into one of their conversations, she can cause all kinds of problems.
• #5: there’s a number of techniques for accomplishing man-in-the-middle attacks. here’s a list of the more common ones, and some of the tools that can be used to perform them. * arp spoofing tricks other machines on the network into thinking you’re the gateway host. this results in the attacking host acting as the router for the network. because it is the router, all packets can be intercepted. * dns poisoning can be used to inject an attackers ip address into the answer section of a dns query. this results in a victim host believing the attacker’s IP is the correct address for, say, paypal.com * 802.11 tricks typically involve setting up a rogue AP. wireless clients connect to the AP, resulting in the attacker again acting as a gateway device and router, able to intercept all traffic from the victim machine. * dhcp exhaustion is generally performed by sending a flood of dhcp request packets, and accepting all resulting dhcp offers until the dhcp server pool has been entirely consumed by the attacking machine. more complicated versions attempt to send dhcp release packets for existing hosts, in an attempt to knock them off the network. once all dhcp addresses are owned by the attacker, it can send out dhcp replies to new requests and assign addresses from the pool it now owns. the result once again is that the attacker becomes the gateway device for the victim machines.
• #6: details in the next few slides
• #7: you’ve just become the router on a network with somewhere between 50 and 150 hosts. you need to intercept specific traffic, monitor it, and potentially manipulate the data being sent between the client and server. how do you do that effectively? *hint*: manually adding iptables for everything you want + managing a crapton of netsed regex statements is not effective.
• #8: when you arp poison a network, it’s essentially you vs. every machine on the segment. because each machine is trying to respond to arp requests with valid information as you’re trying to respond with bogus information, there’s a dramatic increase in the total amount of traffic. additionally, any success is limited, as the valid arp data is constantly being sent by the legit hosts.
• #10: using cain, i arp poisoned my whole network (a /24, with 6 live hosts) i then checked email using imaps, and both twitter and gmail over https. the end result was that, while cain captured the certs, the connections weren’t successfully intercepted. worse, in the case of the twitter connection, cain was able to snarf the twitter information, but it was completely wrong.
• #11: remember tjx and heartland, from back before anti-nony-lulzsec made everyone forget about actual hacking by releasing a tsunami of dox? they are examples of what can happen when someone just passively captures data (crypted or plain). then there’s the obligatory “hipsters sitting in starbucks” credentials theft scenario. whatever.
• #21: code tweaks: updated a lot of files to work with the new directory structured changed the codebase to use native set() instead of python Sets module