Information and Identity Theft Without ARP Spoofing in LAN Environments

Abstract

Nowadays almost every website use a membership based portal in which each user have a series of permissions that allow him to conduct several actions, in order to check which user has which permissions they use a SessionID this ID allows the web portal to identify the user and grant him the permissions and the information that they need or paid for, this SessionID is sent by HTTP requests so if a third person is able to successfully sniff a package and extract the SessionID, this person will be able to access to the system using the permissions of that member. ARP Spoofing it’s a well-known method for sniffing packets although there are effective and easy methods to protect it such as, Static ARP, IDS/IPS systems, port security and other mechanisms of protection. This paper aims to show a technique in sniffing data on a LAN environment without the use of ARP Spoofing in order to be undetectable, unpreventable and effective all focused on Session Hijacking.