Sniffing & Spoofing

Sniffing

Sniffing inspects network traffic in real-time, extracting headers, payloads, and session metadata. It uncovers credentials, tokens, and protocol weaknesses, and establishes situational awareness before or during exploitation.

Common Techniques

Capturing raw packets with promiscuous or monitor mode interfaces Filtering traffic by IP, port, or protocol to isolate valuable data Reassembling TCP streams to read clear-text credentials Following unencrypted protocols (HTTP, Telnet, SMTP, FTP) for rapid intel Leveraging port mirroring, SPAN, or hub-based topologies for full-duplex capture Decrypting TLS when private keys or session secrets are available Extracting files, images, and VoIP calls directly from packet flows

Tools

• Wireshark (GUI packet analyzer with deep protocol dissection)
• tcpdump (lightweight CLI sniffer for scripted captures)
• tshark (Wireshark’s CLI engine for remote or headless use)
• Bettercap (modular MITM framework with live packet capture)
• Zeek (formerly Bro; network security monitor that logs and scripts traffic events)
• Scapy (Python library for custom packet crafting and sniffing)
• pcapplus-based scripts (custom automation around libpcap)

Spoofing

Spoofing forges network identity to redirect traffic, hijack sessions, or bypass access controls. By masquerading as trusted hosts or infrastructure, an operator gains man-in-the-middle positions, network access, and lateral movement capability.

Common Techniques

• MAC spoofing to bypass wireless MAC filtering or port-based NAC
• ARP cache poisoning to position a MITM node inside switched LANs
• DNS spoofing to deliver malicious IPs for trusted domains
• IP spoofing in stateless protocols (e.g., UDP) to mask source or trigger reflection
• DHCP spoofing for rogue gateway injection and traffic capture
• Email header spoofing to improve phishing credibility
• LLDP/CDP spoofing to influence network device topology views

Tools

• arpspoof (classic ARP poisoning utility in dsniff suite)
• Bettercap (real-time ARP, DNS, and DHCP spoofing with interactive console)
• Ettercap (MITM framework supporting ARP, DNS, and SSL stripping)
• macchanger (quick MAC address changer for Linux)
• Responder (rogue SMB/HTTP/MDNS/NBT-NS responder that coerces credential hand-offs)
• Scapy (crafts arbitrary Ethernet/IP packets for advanced spoofing scenarios)
• hping3 (raw-packet generator for IP-level spoofing, testing, and DoS research)
• ip link set / `ifconfig (manual MAC spoofing by taking interface down, changing MAC, and bringing it up)