Re: Sniffing on a switch

From: Stephen J. Smoogen (smooge_at_gmail.com)
Date: 10/29/05

  • Next message: Dave Bush: "Re: Sniffing on a switch" 
    Date: Sat, 29 Oct 2005 07:47:07 -0600
To: Andy Meyers <andy.meyers@hushmail.com>

    On 10/27/05, Andy Meyers <andy.meyers@hushmail.com> wrote:
    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > Now i know people say you "cant" sniff on a switch and I know about ARP
    > poisoning and MAC flooding. But there has to be another way. I have heard
    > too many stories about "he sniffed my AIM conversation on a Cisco switch"
    > (an example is in the most recent version of 2600). Does anyone know of any
    > technique how to do this? Can you ARP poison a switch?
    >
    > Ashes

    Well the easiest way of doing something like this is to just find an
    ill-configured smart switch and taking it over. Ill-configured meaning
    'default' or weak password, SNMP1, no patches, etc. You then can port
    replicate the ports you want to your port and voila you have yourself
    a very expensive hub. 

    --
Stephen J Smoogen.
CSIRT/Linux System Administrator
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 
Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
  • Next message: Dave Bush: "Re: Sniffing on a switch"

    Relevant Pages

    • Re: Scanning Class A network
      ... > Recently I was given a task to carry out a port scan of an entire valid ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • Re: Pen test, tcp/1404 found - advice needed
      ... Mr seKurity Wizard next time try searching for the port number on the ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • Re: Identification of a Mail Server
      ... Nmap can do more than tell you if a port is open it will also detect what service is running on that port if possible ... How can one identify a mail server behind a firewall, be it Exchange, ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • RE: Hacking to Xp box
      ... restricts most of the attacks that use anonymous connections. ... nessus found port 135 139 ... Audit your website security with Acunetix Web Vulnerability Scanner: ... login pages, dynamic content etc. Firewalls, SSL and locked-down servers ...
      (Pen-Test)
    • RE: Pen test, tcp/1404 found - advice needed
      ... That ICA is repeated every 10 seconds or so, ... into the port. ... Up to 75% of cyber attacks are launched on shopping ... > your website for vulnerabilities to SQL injection, ...
      (Pen-Test)