> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/exam-prep-notes/ceh-v13-master-edition/module-08-sniffing.md).

# Module 08: Sniffing

## Lab 1: Perform Active Sniffing <a href="#lab-1-perform-active-sniffing" id="lab-1-perform-active-sniffing"></a>

Active sniffing involves sending out multiple network probes to identify access points. The following is the list of different active sniffing techniques:

* **MAC Flooding**: Involves flooding the CAM table with fake MAC address and IP pairs until it is full
* **DNS Poisoning**: Involves tricking a DNS server into believing that it has received authentic information when, in reality, it has not
* **ARP Poisoning**: Involves constructing a large number of forged ARP request and reply packets to overload a switch
* **DHCP Attacks**: Involves performing a DHCP starvation attack and a rogue DHCP server attack
* **Switch port stealing**: Involves flooding the switch with forged gratuitous ARP packets with the target MAC address as the source
* **Spoofing Attack**: Involves performing MAC spoofing, VLAN hopping, and STP attacks to steal sensitive information

### Task 1: Perform MAC Flooding using macof <a href="#task-1-perform-mac-flooding-using-macof" id="task-1-perform-mac-flooding-using-macof"></a>

```
macof -i eth0 -n 10 
```

{% hint style="info" %}
**-i**: specifies the interface and **-n**: specifies the number of packets to be sent (here, **10**).

You can also target a single system by issuing the command **macof -i eth0 -d \[Target IP Address]** (**-d**: Specifies the destination IP address).
{% endhint %}

### Task 2: Perform a DHCP Starvation Attack using Yersinia <a href="#task-2-perform-a-dhcp-starvation-attack-using-yersinia" id="task-2-perform-a-dhcp-starvation-attack-using-yersinia"></a>

```
 ## To open yersenia into interactive mode
 yersinia -I
```

## Lab 2: Perform Network Sniffing using Various Sniffing Tools <a href="#lab-2-perform-network-sniffing-using-various-sniffing-tools" id="lab-2-perform-network-sniffing-using-various-sniffing-tools"></a>

### Task 1: Perform Password Sniffing using Wireshark <a href="#task-1-perform-password-sniffing-using-wireshark" id="task-1-perform-password-sniffing-using-wireshark"></a>

HTTP password & username harvesting using the wireshark

```
http.request.method == POST
```

> **Remote Packet Capture Protocol v.0 (experimental) service can be used to add remote interface using machinIP , access credentials**

## Lab 3: Detect Network Sniffing <a href="#lab-3-detect-network-sniffing" id="lab-3-detect-network-sniffing"></a>

Network sniffing involves using sniffer tools that enable the real-time monitoring and analysis of data packets flowing over computer networks. These network sniffers can be detected by using various techniques such as:

* **Ping Method**: Identifies if a system on the network is running in promiscuous mode
* **DNS Method**: Identifies sniffers in the network by analyzing the increase in network traffic
* **ARP Method**: Sends a non-broadcast ARP to all nodes in the network; a node on the network running in promiscuous mode will cache the local ARP address

### Task 1: Detect ARP Poisoning and Promiscuous Mode in a Switch-Based Network <a href="#task-1-detect-arp-poisoning-and-promiscuous-mode-in-a-switch-based-network" id="task-1-detect-arp-poisoning-and-promiscuous-mode-in-a-switch-based-network"></a>

{% hint style="info" %}
Tool used in this section :&#x20;

**Cain & Abel**
{% endhint %}

Sniffer detector script in wireshark&#x20;

```
nmap --script=sniffer-detect [Target IP Address/ IP Address Range] 
```