PT0-001 · Question #214
A penetration tester is performing a remote internal penetration test by connecting to the testing system from the Internet via a reverse SSH tunnel. The testing system has been placed on a general…
The correct answer is A. # sudo ettercap -Tq -w output.cap -M ARP /192.168.1.0/ /192.168.1.255/. The tester's ARP spoofing command poisoned the entire subnet including the testing machine's own IP, dropping the reverse SSH tunnel; the correct command uses sudo and subnet-boundary targets that ettercap processes while automatically excluding the local machine.
Question
A penetration tester is performing a remote internal penetration test by connecting to the testing system from the Internet via a reverse SSH tunnel. The testing system has been placed on a general user subnet with an IP address of 192.168.1.13 and a gateway of 192.168.1.1. Immediately after running the command below, the penetration tester’s SSH connection to the testing platform drops:
Which of the following ettercap commands should the penetration tester use in the future to perform ARP spoofing while maintaining a reliable connection?
Options
- A
sudo ettercap -Tq -w output.cap -M ARP /192.168.1.0/ /192.168.1.255/
- B
proxychains ettercap -Tq -w output.cap -M ARP /192.168.1.13/
- C
ettercap -Tq -w output.cap -M ARP 00:00:00:00:00:00//80
- D
ettercap --safe-mode -Tq -w output.cap -M ARP /192.168.1.2-255/
- E
ettercap -Tq -w output.cap -M ARP /192.168.1.2-12;192.168.1.14-255/
How the community answered
(20 responses)- A65% (13)
- B5% (1)
- C10% (2)
- D5% (1)
- E15% (3)
Why each option
The tester's ARP spoofing command poisoned the entire subnet including the testing machine's own IP, dropping the reverse SSH tunnel; the correct command uses sudo and subnet-boundary targets that ettercap processes while automatically excluding the local machine.
Running ettercap with sudo provides the raw socket privileges required for ARP manipulation and proper packet forwarding. Specifying /192.168.1.0/ and /192.168.1.255/ as the two MITM target groups covers the full subnet scope; ettercap automatically skips its own IP address during ARP poisoning, so the testing system at 192.168.1.13 is not poisoned and the reverse SSH tunnel is preserved.
proxychains routes TCP traffic through proxy chains but ARP poisoning operates at Layer 2 and cannot function through a TCP proxy; additionally targeting only 192.168.1.13 would poison the tester's own machine.
The command uses a MAC address and port filter rather than valid IP-range target syntax for ARP MITM mode, making it an invalid invocation for this use case.
--safe-mode is not a valid ettercap command-line flag, and the range 192.168.1.2-255 explicitly includes 192.168.1.13, which would still disrupt the reverse tunnel.
The single-target range syntax without a second target group changes how ettercap handles MITM interception, and the absence of sudo means the process lacks privileges for raw socket operations needed to maintain packet forwarding.
Concept tested: Ettercap ARP MITM without disrupting local machine
Source: https://www.ettercap-project.org/ettercap/documentation.html
Topics
Community Discussion
No community discussion yet for this question.