nerdexam
EC-Council

312-50V9 · Question #284

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

The correct answer is A. He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer. After winning root bridge control via STP manipulation, an attacker uses SPAN port mirroring on the spoofed bridge to redirect and capture network traffic.

Sniffing

Question

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

Options

  • AHe will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.
  • BHe will activate OSPF on the spoofed root bridge.
  • CHe will repeat the same attack against all L2 switches of the network.
  • DHe will repeat this action so that it escalates to a DoS attack.

How the community answered

(27 responses)
  • A
    63% (17)
  • B
    11% (3)
  • C
    4% (1)
  • D
    22% (6)

Why each option

After winning root bridge control via STP manipulation, an attacker uses SPAN port mirroring on the spoofed bridge to redirect and capture network traffic.

AHe will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.Correct

Once the attacker controls the root bridge through STP BPDU spoofing, they configure a SPAN (Switched Port Analyzer) session to mirror all traffic traversing the bridge to their own network interface. This allows passive interception of all Layer 2 traffic flowing through the compromised bridge without disrupting normal network operations, making it an effective eavesdropping technique.

BHe will activate OSPF on the spoofed root bridge.

OSPF is a Layer 3 routing protocol and has no relevance to an STP attack, which operates entirely at Layer 2.

CHe will repeat the same attack against all L2 switches of the network.

Repeating the STP attack on all switches is unnecessary because controlling the root bridge already causes all switches to forward traffic through the attacker's device.

DHe will repeat this action so that it escalates to a DoS attack.

STP manipulation is exploited for man-in-the-middle traffic interception, not typically escalated into a denial-of-service attack.

Concept tested: STP manipulation attack post-exploitation traffic interception

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.html

Topics

#STP manipulation#SPAN port#L2 attack#network sniffing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice