‫In DHC spoofing attacks, the attacker places a rogue DHP server on the network.
‫There are two main features of the DHCP mechanism that emerges the DHP spoofing attack.
‫First, there's no authentication process and priority in the DHP mechanism.
‫Second, as clients are turned on and request an address, the server with a fastest response is used.
‫So if the device receives a response from the rogue server first, the rogue server can assign any address
‫as well as control which device it uses as a gateway.
‫So a well-designed attack can funnel traffic from local hosts to a rogue server that logs all the traffic
‫and then forwards that traffic out to the correct gateway to the device, and this action would be almost
‫transparent.
‫Right?
‫That's the attacker can steal information or pretty much invisibly.
‫How are you going to how are you going to find that?
‫That's why you're here.
‫Let me call you in on another important point while setting up a rogue DHCP server.
‫It's we cannot be so sure whether the client received the settings of the rogue server or the legitimate
‫server.
‫That's why it's way better to use the DHP spoofing attack with a DHP starvation attack.
‫All right.
‫In a DHP starvation attack, an attacker broadcast a large number of DHCP request messages with spoofed
‫source Mac addresses.
‫If the legitimate DHCP server in the network starts responding to all these bogus DHCP request messages,
‫available IP addresses in the server scope will be depleted within a very short span of time.
‫Now, once the available number of IP addresses in the DHC server is depleted, network attackers can
‫then set up a rogue DHP server and respond to new DHP requests from the Network DHP clients by setting
‫up a rogue DHCP server.
‫The attacker can now launch a whole DHCP spoofing attack.
‫So here is how we can perform a DHP spoof attack together with DHP starvation attack.
‫So we'll create a lot of DHP discovery packets to request new IP addresses from the DHP server.
‫DHCP server replies to these requests.
‫IP address space is limited.
‫For example, a Class C subnet has about 250 IP addresses available.
‫So since the IP addresses are used for fake Mac addresses, there aren't any more IP addresses for legitimate
‫clients.
‫DHP cannot respond to the new request and the clients which cannot have IP addresses, become out of
‫service.
‫So now will set up a rogue DHCP server, which is the only server to respond to the client's IP address
‫requests right now.
‫The Rogue DHP server starts distributing IP addresses and other TCP IP configuration settings to the
‫network DHP clients.
‫TCP IP configuration settings include default gateway and DNS server IP addresses.
‫So now we can replace the original legitimate default gateway IP address and DNS server IP address with
‫our own IP address.
‫Once the default Gateway IP address of the network devices are changed and that clients start sending
‫the traffic destined to outside networks to the attacker's computer.
‫The attacker can now captors sensitive user data and launch a man in the middle attack.