Re: How to sniff packets from afar?

From: ET LoWNOISE (etat_private)
Date: Thu Nov 08 2001 - 12:40:00 PST

  • Next message: Pawel Krawczyk: "Cisco VPN Concentrator"

    You dont need to own the router, you can use your pc to become a
    routerthen spoof the routing protocols used to reroute the traffic to you
    and then sniffit.
    
    Curt Wilson has a excelent paper about it in SANS. www.sans.org
    search for it there.
    
    ET
    
    On Wed, 7 Nov 2001, Penetration Testing wrote:
    
    > On Fri, 2 Nov 2001, Shawn Duffy wrote:
    > 
    > > [snip]
    > > I was wondering if any knows of a way to sniff packets from either his
    > > VPN tunnel connections or traffic through his firewall when you cannot
    > > connect directly in between his ISP and router.
    > 
    > If you can own his router you may be able to capture traffic from it and
    > tunnel it back to your machine.  I believe that this was discussed in
    > Phrack about 2 or 3 issues back.
    > 
    > > I was told it is possible, but I don't see how.  Also, would anyone know
    > > how to tap a T1 line from a dmark without disrupting service and without
    > > knowing the parameters?
    > 
    > You would want to be careful with this.  Even if your friend provides you
    > with authorisation it would probably constitute wiretap and could land you
    > in a heap of trouble with the local authorities (and the carrier).
    > 
    > Just my $0.04 AUD worth...
    > 
    > Dave Taylor
    > 
    > 
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    > Service. For more information on SecurityFocus' SIA service which
    > automatically alerts you to the latest security vulnerabilities please see:
    > https://alerts.securityfocus.com/
    > 
    > 
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Thu Nov 08 2001 - 12:54:01 PST