Eccouncil 312-50 Exam - Topic 8 Question 111 Discussion
Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company.While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?
B) Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing
D) TCP/IP Hijacking
Explanation:
A man-in-the-middle attack using forged ICMP and ARP spoofing is a type of network-level session hijacking attack where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets and intercept or modify the data exchanged between the client and the server.
A man-in-the-middle attack using forged ICMP and ARP spoofing works as follows1:
The attacker sends a forged ICMP redirect message to the client, claiming to be the gateway. The ICMP redirect message tells the client to use the attacker's machine as the next hop for reaching the server's network. The client updates its routing table accordingly and starts sending packets to the attacker's machine instead of the gateway.
The attacker also sends a forged ARP reply message to the client, claiming to be the server. The ARP reply message associates the attacker's MAC address with the server's IP address. The client updates its ARP cache accordingly and starts sending packets to the attacker's MAC address instead of the server's MAC address.
The attacker receives the packets from the client and forwards them to the server, acting as a relay. The attacker can also monitor, modify, or drop the packets as they wish. The server responds to the packets and sends them back to the attacker, who then forwards them to the client. The client and the server are unaware of the attacker's presence and think they are communicating directly with each other.
Therefore, Jake is studying a man-in-the-middle attack using forged ICMP and ARP spoofing, which is a type of network-level session hijacking attack.
Teddy
6 months agoRonny
6 months agoNida
7 months agoShawnda
7 months agoElke
7 months agoMarcos
8 months agoElke
8 months agoMicaela
8 months agoLettie
8 months agoUna
9 months agoTeddy
9 months agoGlenna
9 months agoPansy
9 months agoJaime
9 months agoJamika
10 months agoColetta
10 months agoShayne
6 months agoMollie
7 months agoIndia
7 months agoShoshana
8 months agoHenriette
11 months ago