Overview of DHCP Attacks: How DHCP Works and Potential Security

Assignment Task

Question 1

Another type of attack that was not included in the workshop is DHCP (dynamic host configuration protocol) based attacks. Do a bit of research into how DHCP works and about some DHCP attacks and answer the following questions.

1. What are the 4 packets (messages) that are communicated between the client seeking and IP address and the DHCP server?

2. Are the 4 messages Layer 2 unicast or broadcast (be careful not to confuse between Layer 3 broadcast, which is sending to an IP broadcast address like 10.0.2.255, as opposed to Layer 2 broadcast which is sent to MAC address FF:FF:FF:FF:FF:FF).

3. Therefore, in a switched network, which of the 4 messages in the DHCP negotiation would the attacker be able to observe?

4. Briefly explain what DHCP spoofing and DHCP starvation attacks are executed, and how the two can be used in combination.

This study source was downloaded by 100000781025215 from CourseHero.com on 04-30-2024 15:58:31 GMT -05:00

5. For an adversary looking to perform MITM, which DHCP configuration option(s) would you try to manipulate?

6. Briefly explain how "DHCP snooping " configuration in a switch work to prevent DHCP spoofing ?

Question 2

1. Briefly explain (1 or 2 sentences max) how HTTPS can defeat MITM via ARP cache poisoning.

2. In the same context, why did Chrome developers decided to display "Not Secure" on HTTP websites?

3. In the same context, what's the danger of ignoring a browser error message like this one and clicking on "Continue to this website"?

4. Briefly write an explanation that you might provide to your grandparent (or anyone who may not be IT savvy) why they should be careful when connecting to open WiFi hotspots like the ones at airports.

Question 3

Click the open button to open the website normally, prompting you to need superadmin to view Secret. So I guess I need to change something to make myself superadmin so I can see Secret.

So I used Burp Suite to observe each entire website running, and I found that a POST METHOD was triggered when I pressed the button. There's a cookie in this POST. The cookie is named superuser and has a value of false. I think the superuser and superadmin are the same thing, so I try to change the value of superuser to true. And then get the answer.

Question 4

Here, I use and modify a command of workshop, which enables me to see all the tables in the whole database. Then I find the secret table, and the secret that the topic needs to find should be in this table.

The command is “5' union select table_name,1,1,1,1 from information_schema.tables 

Due to the characteristics of union, the number of columns in the results searched by "SELECT" on the left should be the same as that of the results searched by "Select" on the right. After several attempts, it was found that the number of columns on the left should be 5. So I'm going to add four ones to select “table_name”.

Make the two "select" columns have the same number of columns.

This IT Computer Science has been solved by our PhD Experts at My Uni Paper.