TechKnowSurge

VideoSecurityFree

DEMO: DoS Attack with Rogue DHCP

A rogue DHCP server is an unauthorized device on a network that hands out incorrect IP configuration, preventing clients from communicating properly and causing a denial-of-service condition. This topic also introduces the related concept of DHCP spoofing and how both can be exploited in network attacks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DHCP, the Dynamic Host Configuration Protocol, is responsible for automatically assigning network configuration to devices — including IP addresses, subnet masks, default gateways, and DNS servers — eliminating the need for manual static configuration. This automation is standard across enterprise, public, and home networks, and it introduces a specific vulnerability: any device capable of acting as a DHCP server, once connected to the network, can begin responding to client requests and distributing its own configuration values. When clients receive these incorrect settings, they are placed on the wrong subnet or pointed to invalid gateways, cutting off normal network communication and producing a denial-of-service effect. This can happen accidentally, such as when a consumer router is connected via its LAN port rather than its WAN port, or intentionally, when an attacker plants an unauthorized DHCP server to disrupt network access. Rogue DHCP server attacks are closely related to, but distinct from, DHCP spoofing. A rogue DHCP server refers to any unauthorized device operating as a DHCP server on the network, regardless of intent. DHCP spoofing refers specifically to the act of impersonating a legitimate DHCP server, often as part of a more sophisticated attack chain. While a rogue DHCP server may cause denial of service by corrupting client network configuration, DHCP spoofing can be leveraged further to redirect traffic through an attacker-controlled system, enabling adversary-in-the-middle attacks. Understanding both concepts and the relationship between them is essential for recognizing how DHCP-based threats present in real network environments.

What you'll learn

Explain how a rogue DHCP server causes a denial-of-service condition by assigning invalid network configuration to clients
Distinguish between a rogue DHCP server and DHCP spoofing and identify the types of attacks each technique can facilitate

What's covered

Rogue DHCP Server Attack

DHCP Basics
- Auto-assigns IP Settings
  - IP Address & Mask
  - Default Gateway & DNS
- Enables Device Mobility
- Used on Most Networks
Rogue DHCP Server
- Unauthorized DHCP Device
  - Wireless Router Example
  - Any Device Can Be Rogue
- Wrong Port Plug-in
  - LAN vs WAN Port
- Hands Out Wrong IP Settings
  - Wrong Subnet Assignment
  - Breaks Network Communication
Denial of Service Demo
- Check Legitimate IP Config
- Plug In Rogue Device
- Release and Renew IP
  - Receives Rogue IP Address
  - Cannot Reach Gateway
  - Web Pages Unreachable
Rogue DHCP vs Spoofing
- Rogue DHCP Unauthorized Device
- DHCP Spoofing Emulates Server
- Spoofing Enables MitM Attack

Key terms

Dynamic Host Configuration Protocol: A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
Denial of Service: An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Default Gateway: The router that a device uses to send traffic to destinations outside its local network.
Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Rogue DHCP Server: An unauthorized DHCP server connected to a network that assigns invalid IP configuration to clients, causing a denial-of-service condition or enabling adversary-in-the-middle attacks.
DHCP Spoofing: An attack technique in which a threat actor emulates a legitimate DHCP server to intercept and respond to client requests, enabling denial-of-service or adversary-in-the-middle attacks.

Topics

Dhcp Rogue Dhcp Dhcp Spoofing Denial Of Service Network Attacks Networking

Transcript

How a Rogue DHCP Server Causes a Denial of Service

DHCP is Dynamic Host Configuration Protocol. What DHCP does is it configures devices on the network. So when I take my laptop from my home network and then plug it into maybe the coffee shop network or a company's network, what it will do is it'll automatically assign an IP address, a mask, default gateway, a DNS server, and probably a few other things as well. It will automatically be assigned to the computer, so that way the end user doesn't have to assign this statically. This allows us to be much more mobile, and it's set up on most of the networks that we have out there.

What can happen is we can plug in another device that has a DHCP server on it into the network, and suddenly now one of these client machines is getting a different IP address, with a different mask, a different default gateway and a different DNS server. Therefore now they're struggling to connect to the rest of the devices on the network, because they're not on the appropriate subnet, and therefore they can't communicate correctly with other devices on this network.

The All-in-One Wireless Router

This is a wireless router right here. This is designed to be an all-in-one piece of equipment, so that way you can plug it into your home and just have things work. There's a lot of stuff that's built into it. Number one, it's a router, so it interfaces between your home network and your ISP and it does some routing. Number two, it has a built-in firewall. It also has a wireless access point, so it acts as a wireless access point. It also acts as a switch. It's designed so that when you plug into this switch right here, you can plug in your computer and then it automatically gets an IP address. So it has a built-in DHCP server that hands out these IP addresses.

The problem is that when we plug this into a network, if we plug it in wrong... Let me just give you an example of this. I wanted to set up one of these at one of the companies that I worked for. I was doing some experimenting around — this is when I was first getting into the industry — and what I accidentally did was, rather than plug in the WAN port into the rest of the network, I plugged in the Ethernet side of this, the switch side of this. So what it was essentially doing was handing out IP addresses from this device to devices on this network that were requesting IP addresses. Because of that, they weren't getting the real IP addresses that they needed for that network; they were getting a different IP address. And so those machines couldn't communicate, and it wasn't a good thing. It was causing a lot of problems for a lot of people, because I plugged this in wrong.

So if I were to plug this into my home network, it would just be a regular wireless router that gives its services and stuff. But if I were to accidentally plug this in wrong on a company network, it becomes a rogue DHCP server. Now, this isn't the only thing that can be a DHCP server on your network. It could be maybe your computer — you can plug in your computer or something else into the network and set it up as a DHCP server. So there could be other rogue DHCP servers as well, but I'm going to use this as an example.

The Demonstration

We're going to actually do this in a lab environment. I'm going to show you how to carry out a denial of service attack using a rogue DHCP server. Remember, practice ethical hacking only. You're only to do this on your own network and devices that you own, or on a network and devices that you have permission to carry out this type of attack with.

I'm on a demo machine right here, and what we're going to do is just take a look at its network settings. I'm going to type in cmd and hit Enter to bring up a command prompt, and I'm going to just type in ipconfig. We can see right now this has a legitimate IP address on this network. Because of that, now what I can do is ping other devices on the network — such as, I can ping 10.110.1. And there you go, we can see that there's a ping.

I also can get into a web browser and go to a web page. I brought up a browser, and what I'm going to do is browse to http colon slash and then I'm going to go to 10.1 — excuse me, 30.23 — and hit Enter. This is just to show you that we can get to a web page. This is just a web page I set up to show our demo on.

Next, what I'm going to do is plug this into the network that this machine is on. I'm going to plug it in so that way it's on the LAN side of this, so it can get an IP address from this rogue DHCP server. Now what I've done is I've plugged this rogue access point into the network.

Next, what I'm going to do is jump on my demo machine here again and do an ipconfig slashre. What this is doing is it's removing that IP address from this machine. And then I'm going to do a renew. What we're hoping will happen is that instead of grabbing an IP address from the legitimate DHCP server, now it's going to grab it from the rogue DHCP server. So 192.168.0100 is what it has.

Now let's try to ping something. I'm going to try to ping the default gateway, which for this network is 10.1.10.1. Even though this says 192.168.0.1, that's the rogue access point, and it's not going to get us anywhere because it's not plugged into any kind of internet connection. So I hit Enter on this to ping 10.110.1, and we can see that nothing's reachable there. And if I hit refresh on this page, we see that this is not really refreshing either — it's sitting there spinning looking for it and it's not connecting.

So there you have it. What we've done is essentially there's a denial of service going on, because we've plugged in this rogue DHCP server.

Rogue DHCP Server Versus DHCP Spoofing

There are two similar concepts: a rogue DHCP server, which is a device, and DHCP spoofing, which might be what it's doing. DHCP spoofing would be to emulate a DHCP server on the network. So in this case, maybe we're carrying out an attack doing DHCP spoofing — we're pretending to be the actual DHCP server even though we're not the legitimate one — and maybe one way that we carry that out is through a rogue DHCP server, where we are setting up a separate DHCP server. So that's the correlation between those.

We're going to present this rogue DHCP server, like we did just now, as being more of: maybe you accidentally put a device on the network and now you've got a rogue DHCP server. DHCP spoofing can lead to something like a machine-in-the-middle attack, so we're going to take a little different approach there.

So here's that attack card on a rogue DHCP server. That's going to be a device that's acting as a DHCP server on the network, and it's very similar to DHCP spoofing. It's just an unauthorized DHCP server, and it can be used to carry out a denial of service attack. But as I mentioned, by spoofing a DHCP server what we could actually do is also use it to carry out an adversary-in-the-middle attack.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →