1. Attack effect
- The switch forwards (floods) to all ports, thereby intercepting the packet
2. Attack principle
- The attacker sends a large number of useless data packets with different Mac addresses to the switch, occupying the MAC address table of the switch, so that the data packets sent by the normal communication device to the switch cannot find the corresponding Mac address, and are forwarded to all ports (pan Hong), thus intercepting the packet
3. Experimental environment
- Kali Linux 2022
- eNSP
- Switch S5700
- Client Client1
- Server Server1
- cloud: cloud1
4. Preparation stage
###1. eNSP topology construction
It is the same network segment as my virtual network card address
(2) Server Server1 configuration address 192.168.1.2
And start the FTP service, choose the key point to start the file directory at will.
(3) Configure Cloud1
- Add UDP, VMnet1
- Incoming port 1 Outgoing port 2 Bi-directional channel increase
- Two of the terminal devices simulate normal communication devices in the environment, and Cloud is used to connect to Kali
(4) Test the connectivity of two terminals.
The local environment is connected, and we enter the kali end.
2. Kali Linux configuration
- Connect kali to the same virtual NIC.
- Manually configure the IP to be the same network segment
- ping test network connectivity
3. Return to ensp to view the mac address table of the switch.
We now clear the address table and start the experiment
After the deletion is complete, the mac address table is empty.
5. Attack stage
1. First, we open wireshark to grab the eth0 network card
2. Macof starts flooding attack
View the mac address table at this time
Because too many systems will automatically paginate him.
3. At this time, we try to log in to FTP.
Because the mac address table is full and cannot learn new addresses, the login fails.
Note: It may not necessarily fail to log in because it will broadcast addressing, which may be slow to log in, and the following experiments can also be performed.
We close the attack and log in again.
The login is successful. Since the mac address table is full, the data will be sent to all data ports. We return to wirsker.
We will see the ftp packet that was broadcast just now, track the TCP data flow, and then we can see the account number and password that we just logged in.
So far the attack is over.