MITM : man in the middle attack

1. MITMman in the middle
v1.0
ARP Cache poisoning

2. #what
MAN IN THE MIDDLE !?

3. #what

4. #what

5. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
10.0.0.137

6. #what
Traffic Normal Flow
hacker
access pointvictim
(1) who’s 10.0.0.2
10.0.0.210.0.0.100
10.0.0.137

7. #what
Traffic Normal Flow
hacker
access pointvictim (2) i’m 10.0.0.2
10.0.0.210.0.0.100
10.0.0.137

8. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
(3) hey! 10.0.0.2
request content from
stephack.com plz
10.0.0.137

9. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
(4) request content
stephack.com
10.0.0.137

10. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
(5) stephack.com
response content
10.0.0.137

11. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
(6) hey, 10.0.0.100
this is content of
stephack.com sir.
10.0.0.137

12. #what
Traffic Normal Flow
hacker
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
end flow

13. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137

14. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(1)
i’m 10.0.0.2
i’m 10.0.0.2
i’m 10.0.0.2
.
.
.
(2)
i’m 10.0.0.100
i’m 10.0.0.100
i’m 10.0.0.100
.
.
.

15. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(3) hey! 10.0.0.2
request content from
stephack.com plz

16. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(4) hey! 10.0.0.2
request content from
stephack.com plz

17. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(5) request content
stephack.com

18. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(6) stephack.com
response content

19. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(7) hey, 10.0.0.100
this is content of
stephack.com sir.

20. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
(8) hey, 10.0.0.100
this is content of
stephack.com sir.

21. #what
hacker
MITM attack Traffic Flow
access pointvictim
10.0.0.210.0.0.100
10.0.0.137
end flow