Rogue DHCP Server | Man-in-the-Middle Attack

[@MrAwesomenesh]

You guys rock! This channel has seriously helped my fundamental knowledge as I prepare for higher certs. I love the perspective you guys attack each subject with.

[@Certbros]

Wow thanks! Really appreciate it!

[@ishmaelvaughn9110]

I come to you guys any time I do not understand a networking concept, and every time you guys make it easier and visible for me to understand. Content goes crazy thank you!

[@Certbros]

Thank you Ishmael! Really great to hear the videos are helping. Hope to have more for you very soon!

[@Gajendra463]

I literally took CEH v11 Course but this small video gave me so much knowledge that I actually got from that class.

[@MrArnipress]

It saddens me that such an amazing content has such a little views. Deserves way more than that.

[@electroplank587]

the style and flow of your videos are great. Looking forward to seeing more like these and CCNA material is really helping.

[@Certbros]

Great to hear! Lots more to come.

[@slee2054]

awesome video! thank you for showing how it actually works! I studied Network+ but never knew how it worked and always wondered.

[@Alexei_Nikolaev]

Nice lesson, thanks! The only little thing is missed. The kali Linux settings that forward hacked user's traffic back to router.

[@neealdon2-g6j]

Its so sad that so many people are missing out on these awsome videos😥

[@LoneWolf137]

Thanks for your hard work! Awesome video!!!

[@Certbros]

Thanks! Happy to hear you liked it. These comments make the work worth it 👌

[@sadeeshkumar654]

Brilliant content. Thank you

[@Certbros]

Thank you Sadeesh!

[@MA-nc8uc]

Thank you..Wonderfully done! Much appreciated

[@mrgigs08]

Like I said, you guys are amazing! F**** Bombal that guy is drilling my brains just in vain. That is what I call explanation I mean yours of course! great job guys!

[@mani_logs]

Very nice for learning❤but i think i'ts better to say: IF WEBSITE HAVE (HTTPS) AND SSL OR TSL VERIFICATION, WE CAN'T USE MITM ATTACK. Thanks

[@abhik67590]

Great video, already waiting for the next video.

[@Certbros]

Thank you Abhishek!

[@di0r]

Actually very good video. Subbed

[@grandfatherm5774]

Real goat video

[@SzwarcuKX5]

Lovely content

[@Certbros]

Thank you!

[@BiMathAx]

You need more than 300 likes...

[@Certbros]

Thanks! I'll give you a like for the comment 😀

[@WeBBerTutoriais]

Very Good!! Brazil!

[@Certbros]

Thank you! I would love to visit Brazil one day!

[@mackynikat8833]

. this is nothing but great video though , keep uploading videos like these so that you will not only help to educate but i will also help to spread out the word to prevent cyber hacking

[@TheGodOfAllThatWas]

A rogue DHCP server doesn't even have to be a MITM attack to be a headache..... Things like wireless AP's and some NAS devices can be misconfigured to run DHCP to an internet connection they don't have and cause all kinds of weird headaches. It's especially annoying if the Flash memory it uses for booting is starting to go out and it resets itself to default on occasion, when the default is DHCP to be on, and it's not connected in a manor to handle WAN traffic. Suddenly people get Duplicate IP messages, or can access the LAN but not the internet, or some people can't access anything but others are fine..... And then it goes away when you show up to fix it.... To only come back in a day or two..... The duplicate IP thing is kind of a dead give away, but beyond that it can be a big headache to troubleshoot since like mentioned in the video it's pretty random when your computer will decide it'll take a new IP address.

[@angelnavedo8086]

Thank You !

[@sadisalgama9956]

Good video clip perfectly explained..!!!

[@Best_Blockchan_Builders]

What is the difference between app poisoning and this?

[@Certbros]

I assume you mean ARP Poisoning. The outcome is very similar but the way we achieve it is different. Rogue DHCP / DHCP spoofing requires the attacker to assign malicious IP address information by taking the role of a DHCP server. ARP poisoning requires the attacker to send false information to the network and pretend to be someone he is not.

[@Best_Blockchan_Builders]

@@Certbros Thank you for the explanation

[@Certbros]

No problem Alexander! Happy to help 👍

[@harkaman4205]

Sup man, keep going. Ur vids are very interesting

[@jessil77]

Loved it xo

[@Certbros]

Thank you Jessil!

[@leothalion3983]

This was awesome!!!!!!!

[@Certbros]

Thank you Joseph!

[@erwindee7384]

I know HTTPS protects against this very effectively, but is there any way to make sure that I'm connecting to the right DHCP server when, say, I connect to public Wi-Fi? Let's say I didn't connect to some hacker's Wi-Fi network and I really am on some legitimate coffee shop's Wi-Fi network. How do I make sure I'm getting DHCP from the coffee shop's router?

[@laplongejunior]

I think you can't as DHCP is broadcast based and there's no reason to assume the DHCP would be on the router. In my own lan, the router's DHCP is for static configuration only and unknown clients are issued IPs by my Pihole

[@zakariasabbagh]

Great video!!

[@alurma]

Thanks

[@Certbros]

You're welcome Vasya!

[@espionn]

You missed the word 'snooping' in the description :)

[@Certbros]

Great spot! Thank you 😁

[@ganeshmurugan157]

Awesome video sir.can u uploaded video on icmp redirecting in mitm sir?

[@Certbros]

Thanks for the suggestion. I've added it to the suggestion list. If I get more requests I will definitely look at making this.

[@abdodana2637]

you are correct about https but what if attacker do SSL strip bro ?!!

[@BugsVsHumans]

Hi how can you stop rogue dhcp server from a network? How do you configure the router to stop it?

[@charlenelouise4758]

i just hate configuring dhcp snooping in packet tracer, it doesn't work and it could be a lil buggy

[@8080VB]

K , could you show the same in yersinia ? deploy this rogue attack on yersinia plz

[@Certbros]

Thanks for the suggestion! I'll definitely look to make some Yersinia videos in the future.

[@8080VB]

@@Certbros cool i'll wait

[@martinacapparelli2359]

Sorry, I don't understand what you do at 7:40. How can I open a Cisco router? Can you help me? I really don't know how to do

[@vladislavkaras491]

Great video! Thanks for practical demonstration of how it looks and how it works! I do have a question. When I connect to http (and maybe even https) through the hacker's PC, do I leave such things as cookies, and similiar stuff, that can be used instead of login credintials? Thanks for the video!

[@TheGodOfAllThatWas]

Webserver tells your computer to set a cookie.... Your computer can then potentially send the data in the cookie instead of the using a user name and password. On a non-encrypted connection the hackers PC would see that information (either the instruction from the server to set the cookie, or your computer saying Hey use this cookie) and be able to record the cookies used. I assume there's a tool a hacker could use, but worse case Wireshark would show the raw data. So you wouldn't "Leave" the cookies, but you'd allow the hacker to scan the cookie and recreate it. Like mentioned in the video encryption (Https, or a vpn) would stop this.

[@vladislavkaras491]

@@TheGodOfAllThatWas Thanks for the detailed answer!

[@hellou3874]

thank

[@jaydenritchie1992]

so wifi connection or lan vpn or pppoe logon would eliminate this?

[@pati6239]

Please make a video about APIs

[@Certbros]

Working on it!

[@saifalmarwani]

many thanks Mate : _

[@M3nt4LC4t]

off topic. what about phishing websites that are using https? how the scammer obtain users' credential?

[@Certbros]

Great question! It's now common for phishing sites to use HTTPS. Because the bad guys own the websites, they are able to see what credentials are being inputed by the victim.

[@undeadhero9141]

so how do i stop this please??

[@abhik67590]

So is it possible that i connect to unknown/free wifi in a cafe , so now it is my default gateway? If yes then if i login to http site then the free wifi guy can see my credential using wireshark?

[@M3nt4LC4t]

I think they cannot, even though they can see your traffic accessing Facebook. Because Facebook is using https, our credentials are encrypted.

[@abhik67590]

@@M3nt4LC4t if site is http then is it possible?

[@M3nt4LC4t]

@@abhik67590 yes it is possible. because http traffic are not encrypted. you can see example as in the video.

[@helamanavalos9806]

Ussually you would see two wifi networks , like amm, Starbucks and Starbucks_official, being the first one the real wifi and the second one the wifi that the attacker created so people connects to that and spy traffic with wireshark.

[@abhik67590]

@@helamanavalos9806 ✌Thanks

[@pankajholariya8331]

nice

[@xxxtentacionforever3037]

very nice

[@Certbros]

Thanks

[@silvanabongiorno3292]

👌🥀🖥💻thanks, useful

[@sijorilsenglarians7907]

😍😍😍

[@kevorka3281]

What's a rooter

[@Certbros]

🤷‍♂️

[@wildyato3737]

Now don't trust router....and get fcking Cellular connection..

[@techstuff42]

A tip... I went to increase the speed of the video only to realize it was at 2.0x already. So the tip, don't talk so very slow

[@alfonzo7822]

Is it possible that planting malware on a device could then force all traffic to http so it can be intercepted? I'm dealing with a network attack and I've come to the conclusion that mitm is what I'm dealing with. Unfortunately the devices contain some kind of code that reconnects to some kind of server out there when I've rebooted the router. I think everything will need a clean install once I've figured out how to fix the mess I'm in . Got a new router but due to devices not being clean it's started all over again. Antivirus has found and cleaned heuristic Trojans but I can't figure out how to fix the TV 🫤