http://web.securityinnovation.com/appsec-weekly/blog/bid/63269/How-to-Test-for-Man-in-the-Middle-Vulnerabilities
Step 3: Start testing and exploring
Now that common MitM attack scenarios and their causes and countermeasures have been reviewed, it is necessary to start using available network security tools to test for the presence of MitM vulnerabilities in your environment.
Test for MitM through ARP poisoning
Follow these steps to test for susceptibility to MitM attacks via ARP poisoning:
- Download and install Cain (http://www.oxid.it/cain.html) and Wireshark(http://www.wireshark.org/download.html) on the attacker’s box.
- Run Cain.
- Click Configure in the menu and select the network interface (it can be a wireless interface).
- Click the Sniffer tab and then the Hosts sub-tab.
- Start the sniffer and click the plus (+) sign.
- Select a range of IPs to scan their MAC addresses (include the target box in the range), and then click OK. Both the gateway’s and the victim’s IPs (and their MACs) should appear in the hosts list.
- Click the ARP poisoning sub-tab.
- Click on the plus (+) sign and add an ARP route from the victim to the gateway.
- Start the ARP poisoning attack by pressing the ARP button. As soon as the victim becomes active, its status changes from “idle” to “poisoning.” The lower pane will begin to show the packets being intercepted (see Figure 1).
- Start Wireshark and start capturing network traffic from the same interface selected in Cain.
Expected results: The first check you can conduct to see if the ARP poisoning attack was successful is to run the arp -acommand on the victim’s box (Windows or UNIX). After executing the attack, the entry for the gateway should be that of the attacker’s box, rather than the real MAC of the gateway. For instance, in Windows running arp -a before the attack gives this:
C:\>arp -a
Interface: 192.168.1.33 --- 0x8
Internet Address IP Address Type
192.168.1.1 00-13-49-5c-e3-de dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
After a successful attack, the gateway entry in the victim’s ARP cache will be different; it will equal to the attacker’s MAC:
C:\>arp -a
Interface: 192.168.1.33 --- 0x8
Internet Address IP Address Type
192.168.1.1 00-1b-77-b2-73-f2 dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
A successful ARP poisoning attack will be visible both in Cain and Wireshark. In Cain, the lower pane of the Sniffer->ARP tab shows the packets being sniffed. You can use Wireshark to see the actual contents of the packets (see Figure 2).
Figure 1 - Using Cain to ARP poison a connection between a victim and a gateway
Figure 2 - Using Wireshark to read the contents of the sniffed packets
Note: For more information about ARP poisoning, refer to the How to Test for ARP Poisoning article.
Test for MitM through DHCP spoofing
Follow these steps to test susceptibility to MitM attacks via DHCP spoofing (tested from a UNIX system):
- On the attacker’s system, run the ifconfig command and note the current IP address and network mask. Take note of the system’s DNS resolver IP as well. (On UNIX systems, DNS server information generally resides in the file /etc/resolv.conf.)
- Download and install Ettercap (http://ettercap.sourceforge.net/download.php) on the attacker’s system.
- Run Ettercap with the GUI option for simplicity: ettercap -G.
- Remove any targets from Ettercap (this is required for DHCP spoofing).
- Use the main menu to navigate to Mitm->DHCP Spoofing.
- Fill in DHCP spoofing server information, providing an IP pool with a range of 15 IPs, as shown in Figure 3.
- Click OK to start the attack.
- On the victim’s computer (Windows), use ipconfig /release to release the current DHCP lease.
- Execute ipconfig /renew to request a lease from the DHCP server; this triggers the attack.
- On the victim’s computer, attempt to connect to an FTP server and supply login credentials.
Expected result: The MitM attack succeeds if executing the ipconfig /renew command in step 8 sets the default gateway on the victim’s machine to the attacker’s IP address. In addition, if the attack succeeds, Ettercap (or other tools on the attacker’s machine) can capture the username and password provided in step 9, as well as any other IP traffic destined for the Internet or networks other than the local subnet.
Figure 3 - Using Ettercap to execute DHCP Spoofing attack
