TechKnowSurge

VideoSecurityFree

DEMO: DHCP Spoofing

DHCP spoofing is an attack in which a malicious host impersonates a legitimate DHCP server to feed false network configuration data to connecting clients, enabling traffic interception, DNS manipulation, and adversary-in-the-middle attacks. This content covers how the attack works and demonstrates its execution using Ettercap on Kali Linux.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DHCP is the protocol responsible for automatically assigning IP addresses, subnet masks, default gateways, and DNS server settings to devices as they join a network. The process begins with a broadcast discovery message sent by any newly connected client, which any DHCP server on the segment can answer. Because this initial broadcast reaches every device on the network, an attacker positioned on the same segment can intercept the request and respond with a crafted DHCP offer before the legitimate server does, substituting malicious configuration values for legitimate ones. The consequences of a successful DHCP spoofing attack depend on which configuration parameters are falsified. Assigning an incorrect IP address or subnet mask can isolate a victim from the rest of the network entirely. More commonly, attackers redirect the default gateway to point to their own machine, forcing all outbound traffic to pass through it. From that position, the attacker can perform adversary-in-the-middle interception, serve fraudulent web content, delay communications, or drop packets altogether. Spoofing the DNS server setting extends this control further, allowing the attacker to resolve any domain name to an IP address of their choosing and redirect victims to counterfeit sites or attacker-controlled infrastructure. A hands-on demonstration walks through the execution of this attack using Ettercap on a Kali Linux system. After selecting the target network interface and configuring a rogue IP address pool and DNS settings within Ettercap's DHCP spoofing module, a Windows victim machine releases and renews its DHCP lease. The victim receives an address from the rogue pool along with the Kali machine's own IP address as its default gateway. Wireshark captures on the Kali machine then confirm that all outbound traffic from the victim is flowing through the attacker, illustrating how a single DHCP spoofing event can serve as the entry point for a broad range of follow-on network attacks.

What you'll learn

Explain how DHCP spoofing enables an attacker to intercept network traffic by supplying fraudulent IP configuration settings, including default gateway and DNS server values
Identify the downstream attacks facilitated by DHCP spoofing, such as adversary-in-the-middle interception, DNS spoofing, and rogue gateway redirection

What's covered

DHCP Spoofing

How DHCP Works
- Client-Server Communication
  - Broadcast Discovery
  - Four-Way Handshake
- Information Handed Out
  - IP Address and Mask
  - Default Gateway
  - DNS Server
Attack Mechanisms
- Rogue DHCP Server
  - Responds Before Legitimate Server
- Default Gateway Spoofing
  - Adversary in the Middle
  - Traffic Interception Control
- DNS Spoofing
  - Redirect Name Resolution
  - Send Victim to Fake Site
Attack Demonstration
- Ettercap on Kali Linux
  - Select ETH0 Interface
  - Configure IP Pool Range
- Victim Requests IP Address
  - DHCP Release and Renew
  - Kali Box Responds With Offer
- Wireshark Traffic Capture
  - Victim Traffic Through Kali
Attack Outcomes
- Leads to Gateway Spoofing
- Leads to DNS Spoofing
- Leads to Website Spoofing

Key terms

Dynamic Host Configuration Protocol: A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
DHCP Spoofing: An attack technique in which a threat actor emulates a legitimate DHCP server to intercept and respond to client requests, enabling denial-of-service or adversary-in-the-middle attacks.
Default Gateway: The router that a device uses to send traffic to destinations outside its local network.
Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.
DNS Poisoning: An attack that corrupts the DNS cache to redirect users to malicious websites.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Dhcp Spoofing Adversary In The Middle Dns Spoofing Network Security Ettercap Kali Linux Networking

Transcript

What DHCP does

DHCP is dynamic host configuration protocol. DHCP is a service that we run on almost all of our ethernet networks that we have, and we run it so that when machines connect to it, they can get an IP address and have connectivity.

How this works is there's a DHCP client service that's running on the desktop machine, or somebody who's connecting to this network, and then something has a DHCP server on it. So it could be running — let's say this is a server that might be running DHCP services, maybe it's this firewall or default gateway, whatever the case may be — we have some sort of server that's running on this network that hands out these IP addresses.

There's also a DHCP protocol, and the idea behind this is that when something connects to the network, it says, hey, does anybody have an address for me, I need an address. That gets broadcast out all connections, and then any DHCP servers that are listening on there respond back and say, hey, yeah, I am a DHCP server and here's some information. And then it goes through one little more: okay, great, I'm accepting that; okay, great, you've accepted that. So that's kind of this little four-way communication that happens there. But this is a protocol, and like I say, this initial request gets broadcast out everywhere on the network.

Because of that, if we have an attacking machine that's sitting on the network and somebody connects and it gets sent out to all devices on this network, what this attacking machine sees is that oh, this machine wants an IP address on this network, and it can respond back and say, okay, here is an IP address.

Why spoof a DHCP server

Why would we want to spoof a DHCP server? Well, it hands out the IP address, mask, default gateway, and DNS server settings. So if we're telling this machine any of those pieces of information, we could manipulate any one of these aspects.

For instance, the IP address and mask. We could give them an IP address and mask of a whole other network that doesn't even exist on this network, and then they really can't communicate well to the rest of the devices on this network, because they think they're on a whole other network. So that's one thing that we can do with it.

We can also change the default gateway and DNS server, which I would say is a little more standard in this scenario. The default gateway is what this computer would use to access the rest of the world. So in this diagram right here it would be this firewall — this is the default gateway. So now this computer, if it needs to access maybe some sort of web server that's out there, what it can do is send its packet to the firewall, and then the firewall will start sending it along its way to get to that web server. So that's how we communicate to the outside world.

Instead, what we could do is say, oh, your default gateway is this attacking computer. By doing that, now if it wants to get to this web server out there, it would then first send it to this attacking server. Now this attacking server has a lot of ability to control this. It could either try to hand it a fake website and say, oh yeah, this is the website that you're going after, or it could send its data to this web server and just carry out an adversary in the middle. Maybe it delays communication, maybe it carries out some sort of denial of service attack and just stops the communication altogether. Really, this attacking computer now has full control over that.

DNS spoofing

It could also change its DNS settings and do some sort of DNS spoofing. So what it could do is say, oh yeah, I'm actually your DNS server. DNS is for resolving names.

Let's say this computer wants to get out to the outside world and get to the website technj.com. So it wants to go to technodej.com, and what it's going to do is a name lookup and say, okay, well, what is www.technodj.com? And rather than getting the original address of where it needs to go, instead it's going to go to this spoofed DNS server, and that DNS server will respond and say, well, this is the IP address that you're looking for — which happens to be itself.

So now all that traffic is going to be sent to this attacking computer. Or it could be something outside, it could be another website out on the outside acting as if it's technodj.com, and so then this computer is going to be communicating with that service right there. So the attacking computer really has control over any kind of name resolution, and can send this computer to wherever it wants to send that computer to.

Carrying out the attack

I'm going to show you the steps to carry out this type of attack. Remember, this is for ethical hacking purposes only. So only do this on your own network and devices, or networks and devices that you've gotten permission to carry out these types of attacks on. Otherwise it's considered cyber crime and could be met with penalties such as fines or being thrown in prison.

I'm on my Kali Linux box, and we're going to use a program called Ettercap. So what I'm going to do is click on our menu item here, our applications, and type in Ettercap and launch Ettercap.

Once this program is launched, we can select which interface we want to use. For this machine, it's going to be eth0 — that's the network that we're attacking. So we're going to click on eth0, and then we're going to start it by clicking this check box, and that gets it started. Now it's starting this sniffing that's happening on this network.

Next up, we're going to start a DHCP snooping attack. So I'm going to click this button right here and go to DHCP spoofing. So we've got DHCP spoofing, and then the IP pool that we're going to use. In this case we're going to use the same pool that is going to be part of this network, so it's going to be 10.1.10, and we're going to do just the top half of this — or maybe we'll just do this small range, so maybe 125 through 135, just a few addresses there. The net mask will be 255.255.255.0, it's a /24. And the DNS server that we are going to use, we're just going to use 8.8.8.8. Then click on okay.

Forcing the victim to renew

I'm on my demo machine. This is the victim machine. What we'll do is start out just by typing ipconfig. As we can see right here, it's got an IP address, but it's got an IP address not in the range that we specified by that Kali box. So what we need to do now is remove that off of here. So I'm going to do an ipconfig /release and hit enter, and then we're going to renew this.

Now what it's doing is sending out a new message of hey, who out there can provide me with an IP address, and it's looking for an IP address. Now what we want to happen is the Kali box to respond and say, here's an IP address in that range that we specified. And look, we've already got it popped up here — so it has now 10.110.128. So now it is connected, and essentially what we've done is we've done IP spoofing. So it's connected via the Kali box.

Reading the attack from the Kali box

If we jump back onto our Kali box, we can get a hint on what's happened here. It tells us what communication happened. First of all, it has a MAC address here. This is the MAC address of the victim box, and it sent out a communication that was broadcast out, and that's the DHCP discover. The DHCP discover is like a hey, does anybody have an IP address that I can use?

Then this machine responded with a fake offer, and it's a fake offer for the IP address of 10.110.128. But look at the gateway which it was giving — it was giving that 10.110.31. Well, what IP address is that? Let's go open up a terminal here and do an ip a here, and we see that that's actually the IP address of this box.

So now what's happening is that if this victim machine wants to get out, then it's going to send that all through the default gateway, which is this Kali box. So all of the traffic is going to go through the Kali box. It finishes up with the victim machine here requesting that 128 address, and then there's an acknowledgement that happens back. So that's the communication that's happened, and now this is set up as the gateway for that victim machine.

Sniffing the redirected traffic

Since that traffic is now coming to the Kali box, and the Kali box is acting as a machine in the middle or an adversary in the middle, what we can do now is go ahead and open up Wireshark. So I'm going to open up Wireshark and we're going to start sniffing that connection across there. I'm going to sniff eth0 here, and we'll double click on that to start seeing the packets that are coming across there. We're going to go back to that Windows machine and generate some traffic now, and then see what it looks like inside of Wireshark.

I'm on this victim machine here, and we can see that the victim machine is going to the 10.110.31 — that's the default gateway, which is that Kali box. So that all adds up. Let's go ahead and open up a browser and browse to a website and see what happens. So we're going to open up a browser here — we'll do Edge, how about that. Just by opening up the browser it's going to generate, see, it's making some communication.

So let's jump over to the Kali box and see what's happening on the Kali box now. On the Kali box we can see that there's a lot of traffic that's being generated. So let's go ahead and stop this activity so we can take a look at it. We see a lot of communication that's coming from the source, which is 10.110.128, to other locations here — so 104.100.168.219. So now what we can see is all this traffic that's trying to go out and trying to make it to these destinations is coming directly to this Kali box right here.

The attack card

Here's that attack card on DHCP spoofing. It's just you're spoofing a DHCP server on the network, so they're not going to the actual DHCP server, but instead they're going to you for their DHCP services. So pretending to be a DHCP server. This commonly leads to other types of spoofing attacks, such as spoofing a default gateway, so all traffic goes through the attacking computer, or spoofing DNS, so you can send this victim to wherever you want to send them through DNS resolution, or spoofing some sort of website.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →