1. Man in the Middle attacks and ARP poisoning explained
Why you shouldn’t ignore invalid certificates
This was orignialy made for a classroom presentation. Step by step text has been added to the slides to provide more information when a presenter is absent. It may be helpful to refer to another guide while watching this slide show.
CrashCourseSecurity.com

2. A review of ARP
In order for host A to begin communication with host B, host A needs to know both host B’s IP address (where it is on the network) and its MAC address (the address for the network adapter)
CrashCourseSecurity.com

3. Host A sends an ARP request destined to host B’s ip address.
Host B responds with an ARP reply and sends its MAC address to host A.
Host A stores the response in its ARP table (also known as an ARP cache) so it can look it up for future reference.
Host A and B can now communicate freely.
CrashCourseSecurity.com

4. ARP Review IP: 192.168.1.1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.5
MAC: BB.BB.BB.BB.BB.BB
ARP table
ARP table
= BB.BB.BB.BB.BB.BB.BB
= AA:AA:AA:AA:AA:AA
Who has ?
1. Host wants to know the MAC address of
sends an ARP request destined to
responds with an ARP reply and sends its MAC address to
stores the response in its ARP table (also known as an ARP cache)
so it can look it up for future reference.
5. The two hosts can now communicate freely.
CrashCourseSecurity.com

5. Fool two hosts into thinking you are
Man in the Middle
Fool two hosts into thinking you are
a legitimate one by using false ARP replies. This allows you to intercept all traffic between the two hosts.
CrashCourseSecurity.com

6. Send fake ARP replies in order to impersonate target hosts.
All legitimate traffic goes to the targeting machine and then gets forwarded to the other victim.
Targets are unaware they are being attacked.
Attacker can listen to data or inject fake data.
Attacker must be on the same physical network.
CrashCourseSecurity.com

7. aLL y0uR bAs3 aR3 b3l0nG to uS, n00b!!
Man in the Middle
IP:
MAC: AA:AA:AA:AA:AA:AA
IP:
MAC: BB.BB.BB.BB.BB.BB
aLL y0uR bAs3 aR3 b3l0nG to uS, n00b!!
ARP table
ARP table
= BB.BB.BB.BB.BB.BB.BB
= CC:CC:CC:CC:CC:CC
= AA:AA:AA:AA:AA:AA
= CC:CC:CC:CC:CC:CC
Attacker
Send fake ARP replies.
ARP packets say that both and
are located at the attacker’s
MAC address of CC:CC:CC:CC:CC:CC
All traffic between two victims is sent
through the attacker.
IP:
MAC: CC:CC:CC:CC:CC:CC
CrashCourseSecurity.com

8. SSL Certificate
Data between two hosts is encrypted using a certificate so third parties cannot eavesdrop.
CrashCourseSecurity.com

9. ? ? SSL Certificates IP: 192.168.1.1 MAC: AA:AA:AA:AA:AA:AA
MAC: BB.BB.BB.BB.BB.BB
Get ? ?
username = johnDoe
password = password1
username = jonDoe
password = password1
i*fk3903kd#1;OKfjm3
Kelq;l(3k_11fkP10394
Attacker
1. Client requests secure web page
2. Client requests certificate from
server.
3. Client encrypts data using
certificate
IP:
MAC: CC:CC:CC:CC:CC:CC
4. Attacker is unable to read
encrypted traffic.
CrashCourseSecurity.com

10. SSL Certificate Forging
CrashCourseSecurity.com

11. An attacker is able to intercept the certificate request and inject a forged certificate.
The attacker can then encrypt the data sent by the client, and then re-encrypt the data with the real certificate when it sends it to the server.
Often times this will cause a certificate warning in browser (See picture on previous slide).
CrashCourseSecurity.com

12. SSL Certificate Forging
IP:
MAC: AA:AA:AA:AA:AA:AA
IP:
MAC: BB.BB.BB.BB.BB.BB
username = johnDoe
Password = password1
Get
username = johnDoe
Password = password1
33k3l*&93)|fka|}3adF[}
Fjek:LE1Qapd13=fda3#+
username = johnDoe
Password = password1
Fjkel(83;aljffke19(30
1. Client requests certificate.
Attacker
Certificate is intercepted by
attacker.
5. Attacker re-encrypts the data
using the original key.
Attacker forges a copy of the
certificate with a new key.
Attacker records bank account
information and books a trip
to the bahamas.
IP:
MAC: CC:CC:CC:CC:CC:CC
Victim encrypts data using
fake key.
CrashCourseSecurity.com

13. ARP poisoning Denial of Service
Attacker tells the victim that the default router cannot be found. No data can be sent outside the network.
CrashCourseSecurity.com

14. ARP poisoning- DoS IP: 192.168.1.1 MAC: AA:AA:AA:AA:AA:AA
MAC: BB.BB.BB.BB.BB.BB
ARP table
ARP table
= BB.BB.BB.BB.BB.BB.BB
= DB:9F:39:1F:92:11
= AA:AA:AA:AA:AA:AA
Attacker
Attacker tells victim the router
is at a non-existent MAC address.
2. No data packets reach the router.
IP:
MAC: CC:CC:CC:CC:CC:CC
CrashCourseSecurity.com

15. CrashCourseSecurity.com
CrashCourseSecurity.com