Hack Security Pro.pdf - Index of

1.Network Sniffing
A) Theoretical Approach
Sniffing is a spying technique which consists in copying the information contained in network packets
without modifying their transportation or their shape.
When an A machine contacts a C machine, data will transit through an intermediate machine, a B
machine.
A -----> B -----> C
To reach C, A must have the packet transit through B. B could be controlled by a hacker, and this
hacker could then maliciously pick up the data transiting between A and C and make a copy of it for
later analysis.
Sniffing makes it possible to pick up the data that makes up the network packets, i.e. the different
options and variables incremented in the packets (Source IP address, Destination IP address, Flags,
etc.), as well as usual data (web pages' source codes, logins and passwords, commands sent to a
server, etc.) The reason sniffing exists is the security weakness of the vast majority of protocols. The
confidentiality of data transmitted with the most common protocols (TCP, HTTP, FTP, SMTP, ...) is not
ensured because these communications are not encrypted. In some network environments, it is not
even necessary to be part of the relay system (router, gateway, etc.) to undertake network sniffing...
Networks environments : simplicity and limits of sniffing
In some network environments, it is not necessary to be in control of the relay machine to spy on the
whole data flow. This is for example the case for network architectures structured around a HUB. The
whole network created around a hub is vulnerable to a Sniffing-type technique. All packets emitted on
the network are broadcast to all the systems present. By analysing the destination MAC address, the
system receiving the packet can decide if this packet is destined to it or if it must be dropped.
However, on a hub network, this method is limited to zones belonging to the same network segment.
Here, machine 1 sends a packet on the
network (its destination is of no relevance to
us). To relay it, the HUB sends it again to
all the other machines of the network.
On this diagram, machine 2 could be a hacker one. It could then spy on all the network traffic of all the
machines linked to the HUB, because all packets are sent back to it.
The Hackademy DMP -62/209- SYSDREAM