Rogue DHCP Server | Man-in-the-Middle Attack

Join the Discord Server!
/ discord
---------------------
MY FULL CCNA COURSE
📹 CCNA - certbros.teach...
FREE CCNA FLASHCARDS
🃏 CCNA Flashcards - certbros.com/c...
HOW TO PASS THE CCNA
📚 Get a great book - amzn.to/3f16QA5
📹 Take a video course - certbros.teach...
✔ Use practice exams - www.certbros.c...
SOCIAL
🐦 Twitter - / certbros
📸 Instagram - / certbros
👔 LinkedIn - / certbros
💬 Discord - www.certbros.c...
Disclaimer: These are affiliate links. If you purchase using these links, I'll receive a small commission at no extra charge to you.
---------------------------------------------------------------------------------------------------------------
Before we start, I need to stress that this video is for informational purposes only. If you know how these attacks work, then you can better defend against them. Do not try this on any system that you do not own or have permission to do so.
DHCP, or Dynamic Host Configuration Protocol, is used to assigned IP address information to computers automatically within a network.
By default, the network is very trusting of any computer claiming to be a DHCP server. Attackers can use this trust to perform a malicious man-in-the-middle attack called Rough DHCP Server or DHCP Spoofing.
This is done by an attacker claiming to be a DHCP server and replying to DHCP messages. The idea is that the rogue DHCP server will assign IP address information but listing itself as the default gateway. This means all traffic destined for the default gateway can be read by the attacker.
In a corporate network, this attack can be avoided by using a feature called DHCP snooping. DHCP snooping is where a switch will drop frames claiming to be a DHCP server on any interface that isn't manually configured as trusted.

[@MrAwesomenesh]

You guys rock! This channel has seriously helped my fundamental knowledge as I prepare for higher certs. I love the perspective you guys attack each subject with.

[@Certbros]

Wow thanks! Really appreciate it!

[@ishmaelvaughn9110]

I come to you guys any time I do not understand a networking concept, and every time you guys make it easier and visible for me to understand. Content goes crazy thank you!

[@Certbros]

Thank you Ishmael! Really great to hear the videos are helping. Hope to have more for you very soon!

[@electroplank587]

the style and flow of your videos are great. Looking forward to seeing more like these and CCNA material is really helping.

[@Certbros]

Great to hear! Lots more to come.

[@MrArnipress]

It saddens me that such an amazing content has such a little views. Deserves way more than that.

[@Gajendra463]

I literally took CEH v11 Course but this small video gave me so much knowledge that I actually got from that class.

[@goobyssi]

awesome video! thank you for showing how it actually works! I studied Network+ but never knew how it worked and always wondered.

[@LoneWolf137]

Thanks for your hard work! Awesome video!!!

[@Certbros]

Thanks! Happy to hear you liked it. These comments make the work worth it 👌

[@sadeeshkumar654]

Brilliant content. Thank you

[@Certbros]

Thank you Sadeesh!

[@neealdon2-g6j]

Its so sad that so many people are missing out on these awsome videos😥

[@Alexei_Nikolaev]

Nice lesson, thanks! The only little thing is missed. The kali Linux settings that forward hacked user's traffic back to router.

[@di0r]

Actually very good video. Subbed

[@MA-nc8uc]

Thank you..Wonderfully done! Much appreciated

[@grandfatherm5774]

Real goat video

[@martinacapparelli2359]

Sorry, I don't understand what you do at 7:40. How can I open a Cisco router? Can you help me? I really don't know how to do

[@mrgigs08]

Like I said, you guys are amazing! F**** Bombal that guy is drilling my brains just in vain. That is what I call explanation I mean yours of course! great job guys!

[@leothalion3983]

This was awesome!!!!!!!

[@Certbros]

Thank you Joseph!

[@WeBBerTutoriais]

Very Good!! Brazil!

[@Certbros]

Thank you! I would love to visit Brazil one day!

[@jessil77]

Loved it xo

[@Certbros]

Thank you Jessil!

[@harkaman4205]

Sup man, keep going. Ur vids are very interesting

[@angelnavedo8086]

Thank You !

[@mackynikat8833]

. this is nothing but great video though , keep uploading videos like these so that you will not only help to educate but i will also help to spread out the word to prevent cyber hacking

[@mani_logs]

Very nice for learning❤but i think i'ts better to say: IF WEBSITE HAVE (HTTPS) AND SSL OR TSL VERIFICATION, WE CAN'T USE MITM ATTACK. Thanks

[@BugsVsHumans]

Hi how can you stop rogue dhcp server from a network? How do you configure the router to stop it?

[@zakariasabbagh]

Great video!!

[@abhik67590]

Great video, already waiting for the next video.

[@Certbros]

Thank you Abhishek!

[@SzwarcuKX5]

Lovely content

[@Certbros]

Thank you!

[@sadisalgama9956]

Good video clip perfectly explained..!!!

[@Best_Blockchan_Builders]

What is the difference between app poisoning and this?

[@Certbros]

I assume you mean ARP Poisoning. The outcome is very similar but the way we achieve it is different. Rogue DHCP / DHCP spoofing requires the attacker to assign malicious IP address information by taking the role of a DHCP server. ARP poisoning requires the attacker to send false information to the network and pretend to be someone he is not.

[@Best_Blockchan_Builders]

@@Certbros Thank you for the explanation

[@Certbros]

No problem Alexander! Happy to help 👍

[@erwindee7384]

I know HTTPS protects against this very effectively, but is there any way to make sure that I'm connecting to the right DHCP server when, say, I connect to public Wi-Fi? Let's say I didn't connect to some hacker's Wi-Fi network and I really am on some legitimate coffee shop's Wi-Fi network. How do I make sure I'm getting DHCP from the coffee shop's router?

[@laplongejunior]

I think you can't as DHCP is broadcast based and there's no reason to assume the DHCP would be on the router. In my own lan, the router's DHCP is for static configuration only and unknown clients are issued IPs by my Pihole

[@jaydenritchie1992]

so wifi connection or lan vpn or pppoe logon would eliminate this?

[@abdodana2637]

you are correct about https but what if attacker do SSL strip bro ?!!

[@BiMathAx]

You need more than 300 likes...

[@Certbros]

Thanks! I'll give you a like for the comment 😀

[@abhik67590]

So is it possible that i connect to unknown/free wifi in a cafe , so now it is my default gateway? If yes then if i login to http site then the free wifi guy can see my credential using wireshark?

[@M3nt4LC4t]

I think they cannot, even though they can see your traffic accessing Facebook. Because Facebook is using https, our credentials are encrypted.

[@abhik67590]

@@M3nt4LC4t if site is http then is it possible?

[@M3nt4LC4t]

@@abhik67590 yes it is possible. because http traffic are not encrypted. you can see example as in the video.

[@helamanavalos9806]

Ussually you would see two wifi networks , like amm, Starbucks and Starbucks_official, being the first one the real wifi and the second one the wifi that the attacker created so people connects to that and spy traffic with wireshark.

[@abhik67590]

@@helamanavalos9806 ✌Thanks

[@TheGodOfAllThatWas]

A rogue DHCP server doesn't even have to be a MITM attack to be a headache..... Things like wireless AP's and some NAS devices can be misconfigured to run DHCP to an internet connection they don't have and cause all kinds of weird headaches. It's especially annoying if the Flash memory it uses for booting is starting to go out and it resets itself to default on occasion, when the default is DHCP to be on, and it's not connected in a manor to handle WAN traffic. Suddenly people get Duplicate IP messages, or can access the LAN but not the internet, or some people can't access anything but others are fine..... And then it goes away when you show up to fix it.... To only come back in a day or two..... The duplicate IP thing is kind of a dead give away, but beyond that it can be a big headache to troubleshoot since like mentioned in the video it's pretty random when your computer will decide it'll take a new IP address.

[@vladislavkaras491]

Great video! Thanks for practical demonstration of how it looks and how it works! I do have a question. When I connect to http (and maybe even https) through the hacker's PC, do I leave such things as cookies, and similiar stuff, that can be used instead of login credintials? Thanks for the video!

[@TheGodOfAllThatWas]

Webserver tells your computer to set a cookie.... Your computer can then potentially send the data in the cookie instead of the using a user name and password. On a non-encrypted connection the hackers PC would see that information (either the instruction from the server to set the cookie, or your computer saying Hey use this cookie) and be able to record the cookies used. I assume there's a tool a hacker could use, but worse case Wireshark would show the raw data. So you wouldn't "Leave" the cookies, but you'd allow the hacker to scan the cookie and recreate it. Like mentioned in the video encryption (Https, or a vpn) would stop this.

[@vladislavkaras491]

@@TheGodOfAllThatWas Thanks for the detailed answer!

[@ganeshmurugan157]

Awesome video sir.can u uploaded video on icmp redirecting in mitm sir?

[@Certbros]

Thanks for the suggestion. I've added it to the suggestion list. If I get more requests I will definitely look at making this.

[@alurma]

Thanks

[@Certbros]

You're welcome Vasya!

[@M3nt4LC4t]

off topic. what about phishing websites that are using https? how the scammer obtain users' credential?

[@Certbros]

Great question! It's now common for phishing sites to use HTTPS. Because the bad guys own the websites, they are able to see what credentials are being inputed by the victim.

[@espionn]

You missed the word 'snooping' in the description :)

[@Certbros]

Great spot! Thank you 😁

[@8080VB]

K , could you show the same in yersinia ? deploy this rogue attack on yersinia plz

[@Certbros]

Thanks for the suggestion! I'll definitely look to make some Yersinia videos in the future.

[@8080VB]

@@Certbros cool i'll wait

[@charlenelouise4758]

i just hate configuring dhcp snooping in packet tracer, it doesn't work and it could be a lil buggy

[@sijorilsenglarians7907]

😍😍😍

[@saifalmarwani]

many thanks Mate : _

[@silvanabongiorno3292]

👌🥀🖥💻thanks, useful

[@undeadhero9141]

so how do i stop this please??

[@xxxtentacionforever3037]

very nice

[@Certbros]

Thanks

[@hellou3874]

thank

[@pankajholariya8331]

nice

[@pati6239]

Please make a video about APIs

[@Certbros]

Working on it!

[@kevorka3281]

What's a rooter

[@Certbros]

🤷‍♂️

[@wildyato37]

Now don't trust router....and get fcking Cellular connection..

[@techstuff42]

A tip... I went to increase the speed of the video only to realize it was at 2.0x already. So the tip, don't talk so very slow

[@alfonzo7822]

Is it possible that planting malware on a device could then force all traffic to http so it can be intercepted? I'm dealing with a network attack and I've come to the conclusion that mitm is what I'm dealing with. Unfortunately the devices contain some kind of code that reconnects to some kind of server out there when I've rebooted the router. I think everything will need a clean install once I've figured out how to fix the mess I'm in . Got a new router but due to devices not being clean it's started all over again. Antivirus has found and cleaned heuristic Trojans but I can't figure out how to fix the TV 🫤