Free Preparation Discussions
MENU
Eccouncil Exam 312-50 Topic 6 Question 95 Discussion
Topic #: 6
Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company.
While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?
A man-in-the-middle attack using forged ICMP and ARP spoofing is a type of network-level session hijacking attack where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets and intercept or modify the data exchanged between the client and the server.
A man-in-the-middle attack using forged ICMP and ARP spoofing works as follows1:
The attacker sends a forged ICMP redirect message to the client, claiming to be the gateway. The ICMP redirect message tells the client to use the attacker's machine as the next hop for reaching the server's network. The client updates its routing table accordingly and starts sending packets to the attacker's machine instead of the gateway.
The attacker also sends a forged ARP reply message to the client, claiming to be the server. The ARP reply message associates the attacker's MAC address with the server's IP address. The client updates its ARP cache accordingly and starts sending packets to the attacker's MAC address instead of the server's MAC address.
The attacker receives the packets from the client and forwards them to the server, acting as a relay. The attacker can also monitor, modify, or drop the packets as they wish. The server responds to the packets and sends them back to the attacker, who then forwards them to the client. The client and the server are unaware of the attacker's presence and think they are communicating directly with each other.
Therefore, Jake is studying a man-in-the-middle attack using forged ICMP and ARP spoofing, which is a type of network-level session hijacking attack.
Network or TCP Session Hijacking | Ethical Hacking - GreyCampus
Annice
2 months agoAshlyn
2 months agoLachelle
2 months agoCristy
2 months agoArt
2 months agoDawne
29 days agoMarisha
1 months agoAnnett
1 months agoSanda
1 months agoCandida
1 months agoMireya
1 months agoDahlia
1 months agoAdaline
1 months agoPhillip
1 months agoDaryl
1 months agoRoslyn
2 months agoBeckie
2 months agoElfrieda
2 months agoLindy
2 months agoPamela
2 months agoJillian
3 months agoFrankie
3 months agoLenna
1 months agoRolande
2 months agoTerina
2 months agoMariko
2 months ago