Yes, that's right.
It's time to talk the basics of sniffing.
We have to understand that when we talk sniffing most of the time in a certified ethical hacking perspective,
we're talking about specifically network sniffing, packet sniffing, using network interface cards
in promiscuous mode.
Now, I've got to tell you something right now, it is something that you often hear about as internal
reconnaissance, and that is individuals on your network that have converted their network interface
card or had Wireshark to it.
A tool like Wireshark, of course, is a network sniffing packet sniffer, and they have Wireshark and
their network card has been moved to promiscuous mode and they are capturing packets.
Now, this should really never happen internally.
Why is that?
Well, what we seek to do is we seek to lock down every single workstation that connects to your internal
network and lock it down so that Wireshark, in fact, no application can be installed in that user's
desktop, but in a more sophisticated controlled environment, maybe it is Wireshark specifically or
win Pcap or end cap or USB cap, any of those capture protocols and programs that are looking to take
the NIC and make it promiscuous mode.
So just understand that that should be very, very rare that you have internal users turning on a packet
sniffer.
We typically make this part of the network policy that they can't do.
It's enforced through the security settings on their workstations.
It's all good.
Now understand that if someone is sniffing packets and they're in a transparent, switched infrastructure,
they get pretty bombed pretty quickly.
And that's because the switches are doing what they were built to do.
Intelligently forwarding filter frames only to those workstations that need to receive it.
So when they're eavesdropping, they're only getting their conversation, let's say, with some other
node.
And that's probably not what they want to get.
They want to get other conversations, especially if they're doing the sniffing as a stage of reconnaissance.
So ARP spoofing and MAC flooding are two things that we're going to be talking about as methodologies
to go ahead and try and intercept traffic that would not otherwise be for that recipient.
Now there's passive versus active sniffing.
You probably wouldn't be surprised, right?
You're not surprised at all that we're breaking this subject down to passive and active like we do so
many of our certified ethical hacking topics.
Passive here means we are just grabbing the traffic, we're doing our analysis, and no one would know.
And there is no manipulation made of the traffic.
But if we are grabbing packets and manipulating things in any way, shape or form, we would consider
that active sniffing of the network.
Keep in mind that the active sniffing, just like any kind of more active attack, is going to be many
times much more worthwhile.
Get much more information, get more valuable information, but it comes at the risk of getting caught.
So there's that balancing act once again.
What would be typical steps then in a sniffing style of an attack?
Well, the attacker would first find the switch.
They're going to attack, and then they would begin discovering everything they can about the network.
They would then select a target machine and they would begin to spoof our addressing so that traffic
is being sent to them.
That should be being sent to that target machine.
This is the classic man in the middle style of attack as the the attacker is now playing the role of
the target and it is receiving the packets.
That's that man in the middle.
The attacker now, of course, can analyze and steal data that was intended for that target machine.
Now, one of the steps that we are going to impress upon you here for keeping these types of attacks
at bay and keeping them where they're not going to cause a huge issue for your organization.
One of the initial steps that we want to talk about right away is for you to eliminate those protocols
that will send information in clear text.
Look at this.
It's a long list.
Notice that with HTP, there's HTP s as the alternative.
With FTP, there's SFTP, so there's often going to be secure variations.
Hey, I had telnet on the brain and listed it twice there.
Sorry about that.
But yeah, telnet is not going to be what we want to access.
The remote terminal will use H, which is going to give us the security we're looking for.
Notice I did flag simple network management protocols version one and specifically to see is the version
that is commonly used out there.
Those versions version one, version two version to see all of those versions, they are not secure.
The SNP version three can be configured in a secure manner and that's why I didn't put it on this list.
So we want to make sure that we stop using protocols like this that would be vulnerable to sniffing
attacks if we have to use them, like the post office protocol or pop functionality.
Well, oftentimes we are encrypting that over a VPN connection or something like that so that that traffic
cannot be intercepted.
Well, now that we have a sense for network sniffing, we're going to get in more detail about it in
the remainder of this module.