العائد الأمني: ثلاث هجمات كلاسيكية — انتحال ARP و DNS، والوسيط — ولماذا مهارة الالتقاط التي بنيتها هي وسيلة كشفها.
أين تنكسر الشبكات
باختصار
الأهداف
- شرح انتحال ARP و DNS
- وصف موقع الوسيط
- ذكر الكشف والدفاع لكلٍّ منها
Now the security payoff. The same trust that makes networks work also makes them attackable. Three classic attacks all exploit one thing: a machine believing an address claim it should have questioned.
ARP spoofing
On a local network, machines ask "who has this IP?" and trust whoever answers. An attacker simply answers first, with their own MAC address, and traffic meant for the gateway flows through them instead. This is a machine-in-the-middle position.
DNS spoofing
Your machine asks "what is the address of bank.dz?" If an attacker answers before the real server, you connect to their machine believing it is the bank.
Defence
These attacks are loud on the wire. ARP spoofing produces duplicate MAC-to-IP mappings; DNS spoofing produces answers from unexpected sources. A capture — the skill you just built — is exactly how they are detected. Static ARP entries, DNSSEC and encrypted DNS are the mitigations.
Legal
Demonstrate these only on a lab network you built yourself, against machines you own. Running them on a real network is unauthorised interception under Law 09-04.
للمراجعة
- تستغل هذه الهجمات ثقة جهاز بادّعاء عنوان
- تظهر بوضوح في الالتقاط
- ARP الثابت و DNSSEC و DNS المشفّر تصدّها