fragmentation attack for a client about aircrack-ng HOT 4 OPEN

Comment by hirte on 8 Jan 2007 22:03 UTC

there are several challenges involved in this task.

• we need a protocol that generates an answer
• we need to know the exact answer (every bit)

at this point the arp could be used, but as far as

• we need to control the size of the answer

arp is out of the race, while icmp comes to mind, but then there is still the problem of knowing the correct ip in the first place. so we depend on a friendly firewall and the knowledge about the ip.

but there is another problem, the ip header contains an identification (2 bytes). so even if we correctly calculate all the other bytes, we sure can't get this right. there is the possibility of bruteforcing this value, but that would either involve chopchop or a guessing over 2^16^ bits and for each guess sending one frame and check if the guess is correct... so basically every ip protocol won't work. what's left when we discualify arp and icmp? i haven't a clue.

from aircrack-ng.

Modified by darkAudax on 8 Jan 2007 22:03 UTC

from aircrack-ng.

Modified by hirte on 8 Jan 2007 22:03 UTC

from aircrack-ng.

Modified by misterx on 8 Jan 2007 22:03 UTC

from aircrack-ng.