Network sniffing helps you understand which users are using services you can exploit, and
IP spoofing can be used to poison a system's DNS or ARP cache, so that all their traffic is sent to a man in the middle (your designated host, for instance). Sniffing and spoofing are often used against the Windows endpoints in the network, and you need to understand the techniques that the bad guys are going to be using:
- Sniffing network traffic: There are many tools to sniff network traffic, but they all work on the same principle. Capturing packets readable by your Network Interface Card (NIC). There are hundreds of protocols, and thousands of TCP/IP ports. It is safe to say that you will not have to learn about all of them, but you will probably learn a couple of dozen.
- Spoofing network traffic: The TCP/IP system is trusting. The general assumption underlying...