312-50 Question 191
Single answer▪ Sniffing Technique: ARP PoisoningDuring an internal penetration test on a switched IPv4 office network, you are authorized to capture traffic between a finance workstation and the default gateway to validate whether sensitive application data is exposed in cleartext. You have Layer 2 access to the same VLAN as the target host. Port mirroring is not available, and the environment uses standard Ethernet switching with no Dynamic ARP Inspection enabled. Which technique would most effectively allow you to place your system in the path of the traffic so you can sniff packets between the workstation and the gateway?
- A
Perform ARP poisoning against both the finance workstation and the default gateway so each maps the other's IP address to your MAC address
- B
Send gratuitous ICMP echo replies to the finance workstation so it updates its routing table to forward all traffic through your system
- C
Flood the switch CAM table until it begins broadcasting all VLAN traffic to every port, then passively capture packets
- D
Send forged DNS responses to the finance workstation so all traffic to the gateway is redirected through your system
Show answer and explanation
Correct answer: A
Explanation
On a switched Ethernet network, passive sniffing is limited because unicast traffic is normally delivered only to the intended switch port. ARP poisoning is effective on IPv4 LANs because Address Resolution Protocol lacks authentication. An attacker on the same broadcast domain can send forged ARP messages so the victim associates the gateway IP with the attacker's MAC, and the gateway associates the victim IP with the attacker's MAC. If IP forwarding or packet relaying is enabled on the attacker's machine, traffic continues flowing while being captured, creating a practical man-in-the-middle position.
This aligns with real-world penetration-testing methodology and defensive guidance. ARP is defined in RFC 826, which does not include built-in authentication. Mitigations such as Dynamic ARP Inspection, static ARP entries in limited cases, port security, and encrypted protocols reduce the impact of ARP-based interception. From a best-practice perspective, organizations should not rely on switched networks alone for confidentiality, because local Layer 2 attacks such as ARP poisoning can still expose unencrypted data.
- A. Correct.
Correct. ARP poisoning, also called ARP spoofing, is a classic man-in-the-middle technique on local IPv4 networks. By sending forged ARP replies to the victim host and the default gateway, the attacker causes each system to associate the other party's IP address with the attacker's MAC address. Because ARP is stateless and many operating systems accept unsolicited ARP replies, traffic can be relayed through the attacker's machine, allowing sniffing and potential modification. This is the most direct and practical technique in the scenario described.
- B. Incorrect.
Incorrect. ICMP does not control Layer 2 address resolution or default-gateway forwarding behavior in this way. Hosts do not update their routing tables based on unsolicited ICMP echo replies. A candidate might choose this option if they confuse network reachability testing with route manipulation, but ICMP echo messages are not used to transparently insert a host into the path between a workstation and its gateway.
- C. Incorrect.
Incorrect. CAM table flooding is a different sniffing-related attack against switches, sometimes called MAC flooding, and it attempts to degrade switching behavior so traffic is flooded more broadly. However, it is noisy, unreliable on modern switches, and does not specifically position the attacker as a man-in-the-middle between one host and the gateway. The question asks for the most effective way to place the attacker's system in the traffic path in this environment, which is ARP poisoning.
- D. Incorrect.
Incorrect. DNS spoofing can redirect name resolution for specific domains, but it does not alter Layer 2 forwarding between a host and its default gateway. The victim still sends traffic to the gateway's MAC address for off-subnet communication unless ARP resolution is manipulated. This distractor reflects a common misconception that DNS manipulation can replace local traffic interception techniques.