Omphalos: Difference between revisions
| Line 15: | Line 15: | ||
* Flood a network with spoofed MAC addresses, in the hope of forcing fail-open behavior to facilitate attacks (see <tt>macof</tt> from [http://monkey.org/~dugsong/dsniff/ dsniff] and ''Hacking Layer 2: Fun with Ethernet Switches'' from BlackHat 2002) | * Flood a network with spoofed MAC addresses, in the hope of forcing fail-open behavior to facilitate attacks (see <tt>macof</tt> from [http://monkey.org/~dugsong/dsniff/ dsniff] and ''Hacking Layer 2: Fun with Ethernet Switches'' from BlackHat 2002) | ||
* Probe and autodetect CAM sizes and hash functions, allowing for minimal CAM overflows | * Probe and autodetect CAM sizes and hash functions, allowing for minimal CAM overflows | ||
* Autodetect host ARP timings and replacement policies, allowing for stealthy man-in-the-middling | * Autodetect host [[ARP]] timings and replacement policies, allowing for stealthy man-in-the-middling | ||
* Reverse and direct man-in-the-middling (answer all queries for an address, from an address, or both) | * Reverse and direct man-in-the-middling (answer all queries for an address, from an address, or both) | ||
* Gratuitous ARP ("enclosure") | * Gratuitous ARP ("enclosure") | ||
* Controlled SNAT of outgoing traffic at layer 2, to create multiple realistic hosts ("Capgras delusions") | * Controlled SNAT of outgoing traffic at layer 2, to create multiple realistic hosts ("Capgras delusions") | ||
* Automated ARP jamming and man-in-the-middling | * Automated [[ARP]] jamming and man-in-the-middling | ||
* [http://en.wikipedia.org/wiki/Arpwatch Arpwatch-like] layer 2 monitoring | * [http://en.wikipedia.org/wiki/Arpwatch Arpwatch-like] layer 2 monitoring | ||
* VLAN hopping | * VLAN hopping | ||
====802.11==== | ====802.11==== | ||
* Passively attack weak cryptosystems (especially WEP), or do so actively if configured | * Passively attack weak cryptosystems (especially WEP), or do so actively if configured | ||