Le gain sécurité : trois attaques classiques — ARP spoofing, DNS spoofing, machine du milieu — et pourquoi la capture que vous savez faire est le moyen de les détecter.
Où les réseaux cèdent
En bref
Objectifs
- Expliquer l'ARP et le DNS spoofing
- Décrire la position de machine du milieu
- Nommer la détection et la défense de chacune
Now the security payoff. The same trust that makes networks work also makes them attackable. Three classic attacks all exploit one thing: a machine believing an address claim it should have questioned.
ARP spoofing
On a local network, machines ask "who has this IP?" and trust whoever answers. An attacker simply answers first, with their own MAC address, and traffic meant for the gateway flows through them instead. This is a machine-in-the-middle position.
DNS spoofing
Your machine asks "what is the address of bank.dz?" If an attacker answers before the real server, you connect to their machine believing it is the bank.
Defence
These attacks are loud on the wire. ARP spoofing produces duplicate MAC-to-IP mappings; DNS spoofing produces answers from unexpected sources. A capture — the skill you just built — is exactly how they are detected. Static ARP entries, DNSSEC and encrypted DNS are the mitigations.
Legal
Demonstrate these only on a lab network you built yourself, against machines you own. Running them on a real network is unauthorised interception under Law 09-04.
À retenir
- Ces attaques abusent d'une machine qui croit une adresse
- Elles sont visibles dans une capture
- ARP statique, DNSSEC et DNS chiffré les contrent