Which technique makes a tester appear as a trusted server on a local network?
A penetration tester would like to conduct an on-path attack against a target system in a local network. Which of the following techniques should the tester use in order to make the tester appear to have an IP address of a trusted server?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to distinguish between local network on-path attacks and other spoofing methods, with ARP spoofing being the key to intercepting traffic by associating your MAC address with the trusted server's IP.
For an on-path attack in a local network, ARP spoofing is the most effective technique to impersonate a trusted server. Community consensus favors ARP spoofing over DNS, IP, or MAC spoofing for this specific scenario.
Many candidates choose DNS spoofing, but DNS spoofing manipulates name resolution and is not needed when you are already on-path and need to impersonate a specific IP address at Layer 2.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
ARP spoofing sends unsolicited ARP replies to the target, associating the tester's MAC address with the IP address of the trusted server. This causes the target to send frames meant for the server to the tester, enabling an on-path attack. Community comment [1] correctly notes that ARP works locally because the ARP cache is updated and traffic is redirected to the attacker.Why the Other Options Are Wrong
DNS spoofing (B) would redirect the target to a malicious server by corrupting name resolution, but it does not make the tester appear as a trusted IP at the network layer—it changes the hostname-to-IP mapping. IP spoofing (D) only forges the source IP of packets and does not allow receiving replies unless the attacker is on the path or uses additional techniques like IP conflict. MAC spoofing (C) changes the sender's MAC address but does not associate it with the trusted server's IP, so it would not cause the target to send traffic to the attacker. Comment [1] highlights that IP spoofing would only work for one-way traffic unless an IP conflict is created.Community Comment Notes
Comment [1] provides the strongest reasoning, distinguishing ARP spoofing from DNS and IP spoofing by explaining that on-path attacks require receiving replies, which ARP spoofing enables. Comment [2] expresses confusion due to conflicting sources, but the exam's suggested answer is A. The high vote count for A (75) versus B (25) supports ARP spoofing as the expected answer for local network on-path attacks.Official Reference
Exam Strategy
Focus on the layer at which each technique operates: ARP spoofing works at Layer 2 and is ideal for local network on-path attacks. When you see 'local network' and 'on-path' together, immediately think of ARP spoofing, not DNS or IP spoofing.