How effective is ARP MITM today?

Off-topic
1

How effective is ARP MITM today?

Are hackers using ettercap, bettercap now-a-days?
Considering how seldom one would come across a target visiting a HSTS enabled website of interest for the first time right when you intend to strip the SSL option, what are the options or an attacker now-a-days on a shared LAN. Say, responder does not help with everyone running Edge on Windows 11, throwing the option of WPAD etc out of the window.

Is it of worth to try Cain n Able? Does it work in the current scenario? Will you see hashes and be able to fake SSL certs on fly and successfully sniff passwords? Will modern browsers let one use Cain n Able to sniff out SSL cookies and data?

2

ARP MITM (ARP spoofing/man-in-the-middle) attacks can still be effective in certain scenarios, although their effectiveness has decreased over the years due to improved security measures in networks and operating systems. Let’s address your specific questions:

  1. Usage of Ettercap and Bettercap: Ettercap and Bettercap are popular tools for performing ARP MITM attacks. While they are still used by some hackers, their usage may vary depending on the specific requirements and circumstances of an attack. It’s worth noting that the effectiveness of these tools can be limited by modern security mechanisms.

  2. HSTS and SSL stripping: HSTS (HTTP Strict Transport Security) can indeed make SSL stripping attacks more difficult. If a target website has HSTS enabled, modern browsers will automatically redirect HTTP requests to HTTPS, even if an attacker tries to strip the SSL option. This significantly reduces the success rate of SSL stripping attacks.

  3. WPAD and responder: If WPAD (Web Proxy Auto-Discovery) is not an option and the responder tool is not effective due to specific browser or network configurations, the attacker’s options for conducting successful MITM attacks on a shared LAN may be limited. In such cases, other attack vectors might need to be explored, such as exploiting vulnerabilities in network protocols or applications.

  4. Cain and Abel: Cain and Abel is a popular tool for various network attacks, including ARP MITM attacks. However, it hasn’t been actively maintained since 2014, and its effectiveness in modern scenarios is limited. While it may still work in certain situations, it may not be reliable against up-to-date security measures implemented in modern operating systems and browsers.

  5. Sniffing SSL traffic and faking SSL certificates: Modern browsers have become more stringent in detecting and warning users about fake SSL certificates. They employ various techniques such as certificate pinning, certificate transparency, and revocation checks to ensure the authenticity of SSL certificates. As a result, successfully sniffing SSL traffic and faking SSL certificates on the fly has become increasingly difficult.

3

Thanks. Did you use some LLM to answer the above?

4

hahaahahaha Large Language Models why not just say AI. yes chat gpt if you wonder

5

AI is a broader term. I was being specific.
BTW I asked ChatGPT before asking here. Was expecting a more humane response than boilerplate machine generated lines.

6

Yeah LLM is a branch of machine learning but ML is a branch of AI so just for clarity sake, think ~simple~. I gotta say i was actually suprised that chatgpt picked up what you posted because as a human-to-human i couldn’t understand what was written there.

7

Well either this was a brilliant, next level insult hurled towards me or you are worse than a machine at understanding natural language.

8

hahhaaha, lets say it was right in the middle. oh and btw was the response I(chatgpt) gave you good enough for you?

9

ChatGPT first raised its hands up and said that it does not recommend conducting hacking and/or illegal actions but in the same response told me everything similar to what you “(chatgpt)” did. I was dissatisfied with both :frowning:

1 Like