Sit in the path between two machines you own

short · 55 min · Objective 4.1

Task

Use ARP spoofing to place an attacker VM in the path between two other VMs you built, observe what becomes readable and what TLS still protects, and see how noisy and detectable the technique is. On-path attacks are indiscriminate by nature, so this runs only between machines you own.

Steps

  1. On the lab network you own, run a client VM, a server VM offering both a cleartext and a TLS service, and an attacker VM.
  2. From the attacker, ARP-spoof so traffic between client and server passes through it. Confirm you are in the path.
  3. Capture and read the cleartext exchange — credentials, session identifiers — and note it took very little.
  4. Observe the TLS exchange: you see the endpoints, timing, volume and server name, but not the content, unless you make the client accept a certificate you control — which it should refuse.
  5. Look at what your ARP spoofing did to the network: conflicting mappings, a burst of gratuitous replies. This is loud.
  6. Restore the ARP tables and confirm normal routing returns.

Verify

tshark -r /tmp/onpath.pcap -Y "http.authorization || ftp.request.command == USER" 2>/dev/null | wc -l
tshark -r /tmp/onpath.pcap -Y "arp.duplicate-address-detected || arp.opcode == 2" 2>/dev/null | wc -l
tshark -r /tmp/onpath.pcap -Y "tls.handshake.extensions_server_name" 2>/dev/null | wc -l

The first count must be non-zero: you captured the cleartext credential from the path. The second must be non-zero: the ARP spoofing produced the conflicting mappings and gratuitous replies that make it detectable — which is the defender's half of the finding. The third confirms TLS metadata is still visible even though its content is not.

Notes

In the path you get metadata about everything and content of whatever is unencrypted; TLS content stays protected unless the client fails to validate, which is itself the finding. These attacks are indiscriminate — ARP spoofing a segment affects every host on it — so on an engagement they need explicit scope permission, and reporting the CONDITIONS that make it possible is often the right answer instead of demonstrating it. Here, both endpoints are machines you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.