nerdexam
CompTIA

PT0-001 · Question #21

A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below: IP: 192.168.1.20 NETMASK: 255.255.255.0 DEFAULT GATEWAY: 192.168.1.254 DHCP…

The correct answer is B. arpspoof -t 192.168.1.20 192.168.1.254. The correct arpspoof command poisons the target victim's ARP cache by impersonating the default gateway, redirecting the victim's outbound traffic through the attacker.

Attacks and exploits

Question

A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below:

IP: 192.168.1.20 NETMASK: 255.255.255.0 DEFAULT GATEWAY: 192.168.1.254 DHCP: 192.168.1.253 DNS: 192.168.10.10, 192.168.20.10 Which of the following commands should the malicious user execute to perform the MITM attack?

Options

  • Aarpspoof -c both -r -t 192.168.1.1 192.168.1.20
  • Barpspoof -t 192.168.1.20 192.168.1.254
  • Carpspoof -c both -t 192.168.1.20 192.168.1.253
  • Darpspoof -r -t 192.168.1.253 192.168.1.20

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    77% (20)
  • C
    4% (1)
  • D
    15% (4)

Why each option

The correct arpspoof command poisons the target victim's ARP cache by impersonating the default gateway, redirecting the victim's outbound traffic through the attacker.

Aarpspoof -c both -r -t 192.168.1.1 192.168.1.20

This command references 192.168.1.1 as the host to impersonate, but the actual default gateway is 192.168.1.254, so no ARP poisoning of the victim toward the real gateway would occur.

Barpspoof -t 192.168.1.20 192.168.1.254Correct

The command 'arpspoof -t 192.168.1.20 192.168.1.254' sends spoofed ARP replies to the target host (192.168.1.20) claiming the attacker's MAC address belongs to the default gateway (192.168.1.254), causing the victim to forward all its outbound traffic to the attacker and establishing a man-in-the-middle intercept position for the victim's communications.

Carpspoof -c both -t 192.168.1.20 192.168.1.253

This command targets the DHCP server (192.168.1.253) rather than the default gateway (192.168.1.254), meaning general outbound traffic from the victim would not be redirected to the attacker.

Darpspoof -r -t 192.168.1.253 192.168.1.20

This command incorrectly sets the DHCP server as the target and the victim's address as the host to impersonate, reversing the intended roles and failing to intercept the victim's traffic.

Concept tested: ARP spoofing command syntax for MITM attack execution

Source: https://www.kali.org/tools/dsniff/

Topics

#ARP spoofing#MITM attack#arpspoof#network layer attacks

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice