Rogue DHCP Server | Man-in-the-Middle Attack

Join the Discord Server!
---------------------
MY FULL CCNA COURSE

FREE CCNA FLASHCARDS

HOW TO PASS THE CCNA

SOCIAL

Disclaimer: These are affiliate links. If you purchase using these links, I'll receive a small commission at no extra charge to you.
---------------------------------------------------------------------------------------------------------------

Before we start, I need to stress that this video is for informational purposes only. If you know how these attacks work, then you can better defend against them. Do not try this on any system that you do not own or have permission to do so.

DHCP, or Dynamic Host Configuration Protocol, is used to assigned IP address information to computers automatically within a network.

By default, the network is very trusting of any computer claiming to be a DHCP server. Attackers can use this trust to perform a malicious man-in-the-middle attack called Rough DHCP Server or DHCP Spoofing.

This is done by an attacker claiming to be a DHCP server and replying to DHCP messages. The idea is that the rogue DHCP server will assign IP address information but listing itself as the default gateway. This means all traffic destined for the default gateway can be read by the attacker.

In a corporate network, this attack can be avoided by using a feature called DHCP snooping. DHCP snooping is where a switch will drop frames claiming to be a DHCP server on any interface that isn't manually configured as trusted.

[MrAwesomenesh]

You guys rock! This channel has seriously helped my fundamental knowledge as I prepare for higher certs. I love the perspective you guys attack each subject with.

[ishmaelvaughn]

I come to you guys any time I do not understand a networking concept, and every time you guys make it easier and visible for me to understand. Content goes crazy thank you!

[electroplank]

the style and flow of your videos are great. Looking forward to seeing more like these and CCNA material is really helping.

[MrArnipress]

It saddens me that such an amazing content has such a little views. Deserves way more than that.

[Gajendra]

I literally took CEH v11 Course but this small video gave me so much knowledge that I actually got from that class.

[goobyssi]

awesome video! thank you for showing how it actually works! I studied Network+ but never knew how it worked and always wondered.

[Alexei_Nikolaev]

Nice lesson, thanks! The only little thing is missed. The kali Linux settings that forward hacked user's traffic back to router.

[LoneWolf]

Thanks for your hard work! Awesome video!!!

[neealdon-gj]

Its so sad that so many people are missing out on these awsome videos😥

[MA-ncuc]

Thank you..Wonderfully done! Much appreciated

[mrgigs]

Like I said, you guys are amazing! F**** Bombal that guy is drilling my brains just in vain. That is what I call explanation I mean yours of course! great job guys!

[mani_logs]

Very nice for learning❤but i think i'ts better to say: IF WEBSITE HAVE (HTTPS) AND SSL OR TSL VERIFICATION, WE CAN'T USE MITM ATTACK. Thanks

[abhik]

Great video, already waiting for the next video.

[harkaman]

Sup man, keep going. Ur vids are very interesting <3

[mackynikat]

. this is nothing but great video though, keep uploading videos like these so that you will not only help to educate but i will also help to spread out the word to prevent cyber hacking

[sadisalgama]

Good video clip perfectly explained..!!!

[ganeshmurugan]

Awesome video sir.can u uploaded video on icmp redirecting in mitm sir?

[TheGodOfAllThatWas]

A rogue DHCP server doesn't even have to be a MITM attack to be a Things like wireless AP's and some NAS devices can be misconfigured to run DHCP to an internet connection they don't have and cause all kinds of weird headaches. It's especially annoying if the Flash memory it uses for booting is starting to go out and it resets itself to default on occasion, when the default is DHCP to be on, and it's not connected in a manor to handle WAN traffic. Suddenly people get Duplicate IP messages, or can access the LAN but not the internet, or some people can't access anything but others are And then it goes away when you show up to fix it.... To only come back in a day or The duplicate IP thing is kind of a dead give away, but beyond that it can be a big headache to troubleshoot since like mentioned in the video it's pretty random when your computer will decide it'll take a new IP address.

[vladislavkaras]

Great video!
Thanks for practical demonstration of how it looks and how it works!
I do have a question. When I connect to http (and maybe even https) through the hacker's PC, do I leave such things as cookies, and similiar stuff, that can be used instead of login credintials?
Thanks for the video!

[erwindee]

I know HTTPS protects against this very effectively, but is there any way to make sure that I'm connecting to the right DHCP server when, say, I connect to public Wi-Fi? Let's say I didn't connect to some hacker's Wi-Fi network and I really am on some legitimate coffee shop's Wi-Fi network. How do I make sure I'm getting DHCP from the coffee shop's router?