This is a MITM attack…

Test site: http://testphp.vulnweb.com/

To check ARP Tables in Windows or Linux: ``arp -a``

If you get too many entries, grep it:

arp -a | grep ether

Terms:

• ARP: Address Resolution Protocol (maps IP to MAC on a network)
• ARP Request: broadcast to the network requesting MAC of specific IP
• ARP Response: client with that IP responds to requester with its MAC address

Each computer on the network has an ARP table linking IPs with MACs.

• You use this table to exploit the ARP protocol and set up a MITM spoof

1. You spoof the IP/MAC of the router: sent to victim

• Causes the victim to update its ARP table and accociate my MAC with router's IP

2. You spoof the IP/MAC of the victim: sent to router.

• Causes the router to update its ARP table and associate my MAC with victim's IP

This effectively puts you in the middle, intercepting traffic between victim and router. The victim thinks you are the router; and the router thinks you are the victim.

Why ARP Spoofing works: Because the protocol itself is not secure…

1. Clients accept responses even if they did not send a request.
2. Cients trust responses without any verification.

So we send an ARP Response to a target and that target will not verify the response. The target will simply update its ARP table with the response I sent it.

Tools: arpspoof, bettercap

• These tools only set up the ARP Spoof and redirect traffic to your computer (the put you as the Man in the Middle).
• After you set this up, you need to capture and anylize the traffic (with something like Wireshark).

Syntax (usage is always the same):

arpspoof -i [interface] -t [clientIP] [gatewayIP]  # spoofs the client, telling him I am the gateway

arpspoof -i [interface] -t [gatewayIP] [clientIP]  # spoofs the gateway, telling him I am the client

Example (as root):

arpspoof -i eth0 -t 192.168.0.216 192.168.0.1
arpspoof -i eth0 -t 192.168.0.1 192.168.0.216

NOTE: You need to enable port forwarding to allow packets to flow through your machine just like a router.

• As root: ``echo 1 > /proc/sys/net/ipv4/ip_forward``