Finding IP address without DHCP

[Warwulf]

Hello everyone.

I set up a Linksys WRT54GS to get myself familiar with some concepts of pentesting with BT4. Obviously, getting through WEP is no problem, and that is well documented. However, I did encounter some difficulties when changing some settings on the router that I wanted to ask about.

MAC Filtering
Bypassing this is no problem when there's a valid wireless client associated... I just set the wlan adapter to use the same MAC as the one allowed. However, what's the best way to proceed when there's NO wireless clients currently associated?

No DHCPd
Accessing a network is easy if you have a DHCP service running that's courteous enough to provide you with an IP address. But what do you do if there's no DHCP service running? Doesn't even have to apply to encrypted networks, but also for open authentication. It's easy to guess when there's a Class C subnet being used, but what if it's a Class B or Class A? Could be one of hundreds of permutations. Any ideas?

Thanks.

[TAPE]

Well regarding the MAC filtering, there is an option in MDK3 to try to bruteforce the MAC address,
but for that to work the router needs to be 802.11 compliant.

Without DHCPD being enabled on the router, there are several options to try ;
> netdiscover
> kismet
> tcpdump

It is all a lot easier if a client is connected with the above, but netdiscover seems to work pretty well.

[thorin]

No DHCPd
Accessing a network is easy if you have a DHCP service running that's courteous enough to provide you with an IP address. But what do you do if there's no DHCP service running? Doesn't even have to apply to encrypted networks, but also for open authentication. It's easy to guess when there's a Class C subnet being used, but what if it's a Class B or Class A? Could be one of hundreds of permutations. Any ideas?

Why would it matter if it's a larger network block?

Assuming there's a larger network block being used then it's also more likely that there are actually live clients from which you can deduce addressing being used.

[creepykrawler]

arping could help here too.