312-50V10 · Question #162
An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?
The correct answer is A. He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.. After winning root bridge status via STP manipulation, the attacker's next step is to leverage that privileged L2 position to intercept and capture network traffic.
Question
An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?
Options
- AHe will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.
- BHe will activate OSPF on the spoofed root bridge.
- CHe will repeat this action so that is escalates to a DoS attack.
- DHe will repeat the same attack against all L2 switches of the network.
How the community answered
(35 responses)- A49% (17)
- B29% (10)
- C9% (3)
- D14% (5)
Why each option
After winning root bridge status via STP manipulation, the attacker's next step is to leverage that privileged L2 position to intercept and capture network traffic.
Once an attacker controls the root bridge via STP manipulation, creating a SPAN (Switched Port Analyzer) session allows them to mirror all traffic flowing through that bridge to their own machine for passive sniffing. This converts the STP attack into a man-in-the-middle position, which is the primary intelligence-gathering objective of the technique.
OSPF is a Layer 3 routing protocol and has no relevance to an STP-based Layer 2 attack scenario on a spoofed root bridge.
Escalating to a DoS is noisy, detectable, and wastes the stealthy access already gained - traffic interception is far more strategically valuable.
Repeating the attack against other switches is unnecessary because controlling the root bridge already provides a central vantage point over the network's spanning tree traffic flow.
Concept tested: STP root bridge spoofing and SPAN-based traffic interception
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.html
Topics
Community Discussion
No community discussion yet for this question.