Hands-On Penetration Testing on Windows

Bridged sniffing and the malicious access point

In Chapter 1, Bypassing Network Access Control, we built an access point to serve as a backdoor into a network. The access point provided us with DHCP, DNS, and NAT to get us out the eth0 interface attached to the inside network. The attached client was not a victim; it was the attacker on the outside of the building. This time, we're creating an access point, but it's intended for our target(s) to connect to it. The access point will grant them some kind of wanted network access, and the destination network will handle them like normal – in fact, we're going to let the destination network handle DHCP and DNS, so don't even bother with dnsmasq this time. The idea is that we're essentially invisible: ...