TechKnowSurge
TechKnowSurge Catalog Videos Spoofing Attacks
VideoSecurityFree

Spoofing Attacks

Spoofing is a network attack technique where a device or user impersonates a legitimate system component to intercept traffic, disrupt services, or gain unauthorized access. Common spoofing targets include ARP replies, MAC addresses, IP addresses, DHCP servers, DNS servers, and wireless access points.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Spoofing is a foundational attack technique in which a device, service, or identity on a network is falsely impersonated to manipulate how other systems communicate and trust. Because many network protocols rely on self-reported identifiers, such as IP addresses, MAC addresses, or server roles, there is no inherent mechanism preventing a malicious actor from claiming to be something they are not. This makes spoofing relatively straightforward to execute and broadly applicable across many attack scenarios. Common targets for spoofing include ARP replies, MAC and IP addresses, DHCP servers, DNS servers, web servers, and wireless access points. Attackers leverage these impersonations to hide their identity, pose as authorized users, circumvent security controls, or lay the groundwork for more complex attacks. Two of the most significant use cases are denial-of-service attacks and adversary-in-the-middle attacks. In a DHCP spoofing scenario, a rogue server responds to address requests before the legitimate server can, either handing out invalid IP configurations to disconnect victims from the network or supplying a malicious default gateway that routes all outbound traffic through the attacker's machine. A spoofed wireless access point, commonly called an evil twin, mimics a legitimate network to trick nearby devices into connecting through it, enabling eavesdropping, credential theft, and malware delivery. Understanding how spoofing works at the protocol level is essential for recognizing its role as a prerequisite technique in many of the more advanced attacks encountered across network and cybersecurity disciplines.

What you'll learn

What's covered

Spoofing

Key terms

Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Wireless Access Point
WAP
A device that allows wireless devices to connect to a wired network using Wi-Fi.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Default Gateway
The router that a device uses to send traffic to destinations outside its local network.
Evil Twin
A wireless attack in which an attacker sets up a rogue access point that broadcasts the same SSID as a legitimate network, tricking clients into connecting so the attacker can intercept or manipulate their traffic.

Topics

Spoofing Attacks Arp Poisoning Adversary In The Middle Dns Security Dhcp Security Evil Twin Attack Network Security

Transcript

It'd be really easy for me to walk up to somebody and say my name is Jeff, even though my name is Andrew. That is really easy to do, to trick somebody. The same thing can be done when it comes to computers: a computer or device on a network could just claim that they are somebody else. We call it spoofing, and it's real easy to do.

What spoofing is

Spoofing just means to imitate. On a network, when two devices want to talk, what they need to do is ask, hey, who belongs to this IP address? And there's a reply to it. Well, it's very simple for somebody else on the network to claim, oh, that's me.

You could spoof anything on this network. You could spoof a firewall, you could spoof a server, you could spoof an access point, you can spoof the switch. There are a lot of things on this network that you could spoof to carry out certain types of attacks.

Here are some common things that an attacking machine can spoof. They can do a spoof on an ARP reply. They can spoof MAC addresses. They could do IP addresses, wireless access points, DHCP servers, DNS servers, web servers. These are all common things that, if you were to spoof, there could be some real advantages and things that you could take advantage of other people with.

Why would we want to do this

One thing we could do is hide ourselves as an attacker. Or we could pose as a legitimate user on the network, or we can circumvent security. We can carry out some sort of denial of service attack, or we could do an adversary attack.

A denial of service scenario

Let's do a little scenario here. Maybe we're spoofing to carry out some sort of denial of service attack. We put a machine on a network and it pretends to be a DHCP server. Now when a machine gets connected to the network, they ask, hey, who here is a DHCP server? And your machine replies back and says, hey, here's an address for you, you can have this address right here.

A denial of service attack could be as simple as giving them an IP address that does not belong to this network. Maybe this is a 192.168.0.0 network and you give them something from the 10 range. Now this computer can't really communicate on the rest of the network, because it doesn't have the proper IP addressing on it. So this could be a spoofing for a denial of service attack.

An adversary in the middle scenario

Or we can change the game a little bit and carry out an adversary in the middle attack. Let's say we have that DHCP service that we're spoofing here, and we hand out information like an IP address, but it is a legitimate IP address on this network. But we also give them a default gateway of this attacking computer. Now, if this computer wants to get to the outside world, it's going to send it to this attacking machine, and then this attacking machine has carried out a machine in the middle, or adversary in the middle, attack.

The attack card

Spoofing is just that you pretend to be someone else. In this example right here, maybe this adversary is pretending to be a wireless access point. Now, when this machine is connecting, it thinks it's connecting to the legitimate wireless access point, but instead is connecting to a spoofed wireless access point. We call this evil twin.

The attacker pretends to be something else or someone else. The reason is because maybe they're doing some sort of eavesdropping attack, or to gain access to a system, steal money, spread malware. Some examples: they could be spoofing email, IP addresses, MAC address, DHCP addresses, or DNS. It could be many different things that they're spoofing.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →