312-50V9 · Question #609
Which type of sniffing technique is generally referred as MiTM attack?
The correct answer is B. ARP Poisoning. ARP Poisoning is the sniffing technique most closely associated with Man-in-the-Middle attacks because it actively redirects Layer 2 traffic through the attacker's machine.
Question
Which type of sniffing technique is generally referred as MiTM attack?
Exhibit
Options
- APassword Sniffing
- BARP Poisoning
- CMac Flooding
- DDHCP Sniffing
How the community answered
(30 responses)- A3% (1)
- B87% (26)
- C10% (3)
Why each option
ARP Poisoning is the sniffing technique most closely associated with Man-in-the-Middle attacks because it actively redirects Layer 2 traffic through the attacker's machine.
Password Sniffing describes the goal or outcome of intercepting credentials from captured traffic - it is not a positioning technique and does not by itself place an attacker between two hosts.
ARP Poisoning works by broadcasting forged ARP reply packets that map the attacker's MAC address to a legitimate host's IP address, causing victim devices to send traffic to the attacker instead of the intended destination. This positions the attacker transparently between two communicating hosts - the core definition of a Man-in-the-Middle attack. Once in position, the attacker can capture, read, modify, or forward packets without either party being aware.
MAC Flooding overwhelms a switch's Content Addressable Memory table to force broadcast behavior, which can expose traffic but does not surgically position the attacker in-path between two specific communicating hosts.
DHCP Sniffing or DHCP spoofing can be used to redirect traffic by assigning a rogue gateway, but it is a distinct attack vector and is not the technique most commonly labeled as the canonical MiTM method.
Concept tested: ARP Poisoning as a Man-in-the-Middle technique
Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015
Topics
Community Discussion
No community discussion yet for this question.
