Jean-Francois Maes

Jean-Francois Maes

Young Graduate at Dimension Data with special interest in Security and Automation & Co-Founder of Joy-Time

ARP poisoning? Not on my watch!

1 minute read

Turn off gratious ARP

A gratious ARP policy means that Arp tables can be changed instantly whenever someone sends an ARP frame. Turning this off would mean that any potential hacker has a very small window to get in front of the router arp when the arp cache gets refreshed.

Use Dynamic ARP inspection

Dynamic ARP inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. The feature prevents a class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting neighbors. The miscreant sends ARP requests or responses mapping another station’s IP address to its own MAC address. DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges and builds a bindings database of valid tuples (MAC address, IP address, VLAN interface). When DAI is enabled, the switch drops ARP packet if the sender MAC address and sender IP address do not match an entry in the DHCP snooping bindings database. However, it can be overcome through static mappings. Static mappings are useful when hosts configure static IP addresses, DHCP snooping cannot be run, or other switches in the network do not run dynamic ARP inspection. A static mapping associates an IP address to a MAC address on a VLAN.

You May Also Enjoy

Pentest: Lazy Sys Admin

6 minute read

Another day another lab, this is going to be the last linux VM for a while, I’ll do more of them at some point but for now I’ll have to study for CCNA and af...

Pentest: Domo arigato mr. Roboto

9 minute read

Since I want to do the OSCP certifcation next year, I figured it’s time to try and tackle a machine that is listed under “OSCP like” in some forums I scoured...

Pentest: owning Zico2

8 minute read

Another day, another VM to get owned! This time I’m doing an intermediate one called Zico2, as always this VM is available on Vulnhub here. —-

Pentest: owning a docker host

10 minute read

As I did my bachelorthesis around Docker and best practices around Docker, I found it interesting and challenging for myself to break a Docker host. Vulnhub ...