In Dhcp spoofing attacks.
The attacker places a rogue Dhcp server on the network.
There are two main features of the Dhcp mechanism that emerges the Dhcp spoofing attack.
First, there's no authentication process and priority in the Dhcp mechanism.
Second, as clients are turned on and request an address, the server with a fastest response is used.
So if the device receives a response from the rogue server first, the rogue server can assign any address
as well as control which device it uses as a gateway.
So a well-designed attack can funnel traffic from local hosts to a rogue server that logs all the traffic
and then forwards that traffic out to the correct gateway to the device.
And this action would be almost transparent.
Right?
Thus, the attacker can steal information pretty much invisibly.
How are you going to how are you going to find that?
That's why you're here.
Let me clue you in on another important point.
While setting up a rogue Dhcp server, it's we cannot be so sure whether the client received the settings
of the rogue server or the legitimate server.
That's why it's way better to use the Dhcp spoofing attack with the Dhcp starvation attack.
All right.
In a Dhcp starvation attack, an attacker broadcasts a large number of Dhcp request messages with spoofed
source Mac addresses.
If the legitimate Dhcp server in the network starts responding to all these bogus Dhcp request messages
available, IP addresses and the Dhcp server scope will be depleted within a very short span of time.
Now, once the available number of IP addresses in the Dhcp server is depleted, network attackers can
then set up a rogue Dhcp server and respond to new Dhcp requests from the network.
Dhcp clients.
By setting up a rogue Dhcp server, the attacker can now launch a whole Dhcp spoofing attack.
So here is how we can perform a Dhcp spoof attack together with Dhcp.
Starvation attack.
So we'll create a lot of Dhcp discovery packets to request new IP addresses from the Dhcp server.
Dhcp server replies to these requests.
IP address space is limited.
For example, a Class C subnet has about 250 IP addresses available.
So since the IP addresses are used for fake Mac addresses, there aren't any more IP addresses for legitimate
clients.
Dhcp cannot respond to the new requests and the clients which cannot have IP addresses become out of
service.
So now we'll set up a rogue Dhcp server, which is the only server to respond to the client's IP address
requests.
Right now.
The Rogue Dhcp server starts distributing IP addresses and other TCP IP configuration settings to the
network Dhcp clients.
TCP IP configuration settings include Default Gateway and DNS server IP addresses.
So now we can replace the original legitimate default gateway IP address and DNS server IP address with
our own IP address.
Once the default gateway IP address of the network devices are changed, the network client starts sending
the traffic destined to outside networks to the attacker's computer.
The attacker can now capture sensitive user data and launch a man in the middle attack.