Hello, guys, and welcome to another video on this chapter in this video, we're going
to learn how to detect ARP Cache Poisoning attack with Wireshark ARP.
The address resolution protocol is
responsible for translating IP addresses into Mac address.
If your system wants to reach Server on the Internet, that has some IP address.
Let's say, for example, one dot two dot four to five.
The will not go through the wire directly to the wanted Server, but they will have
to jump over, you're router and most likely several other intermediaries.
Until they reach the target, while the destination IP of your packet
remains the same, the Mac address that indicates its
upcoming hope is changing with hope when your systems that said in the packet the
first Mac address will be the one of your Router or Switch.
Your system will know the IP address of that Router because it's
the gateway address in your systems network configuration.
However, the Mac address of that gateway,
it will send out an IP request asking for the Mac address of the Gateway IP.
The problem from a security point of view with ARP is not encrypted gratuitously.
IP packets are allowed.
This means anybody in the network can just come and say hello.
I am the gateway my Mac addresses is so and so.
The system that receives this information will happily take it for granted, even if
it did not ask for the information in the first place.
From that point on, all traffic that was destined for the gateway would be sent to
the attacker because the Attack system thinks that the known
Gateway IP address is most of them, regardless of the attacker faking ARP,
making ARP packets by sending the wrong combination of IP addresses.
And Mac address is called ARP Spoofing the
process of messing up the Attack systems ARP table word the
word store that information for a few seconds is then called ARP Poisoning,
so let's just go ahead in our Kali Linux machine.
And see how we can perform ARP
bASH poisoning Attack and how to easily detect that using Wireshark.
So in this video, we are going to run Metasploit
in our test environment to perform an ARP poisoning attack against another lab
system that I have set up visually in my computer.
So please go ahead and open
a terminal in your Kali Linux and we can just go ahead and type a massive console.
But once Metasploit is loaded.
We are presented with the appropriate screen that those are so
so now I'm not going to get into more details about Metasploit.
There's a lot of things been going on, but
keep following the commands and instructions that I'm placing.
So we can if you want to do that at home, you can perform an ARP poisoning Attack.
And you can use Wireshark to detect it.
So we're going to use some auxiliary
so we're going to use the ARP poisoning auxiliary in this console.
So with that, we can just go ahead and type use.
And then.
auxiliary/spoof/arp/arp_poisoning and press enter.
And as you can see, the auxiliary mode that we chose, it's also.
It is present in front of us that it has been selected and this way
Metasploit usually will do all the dirty work for us.
We just have to provide some more details to make Attack work properly.
So that would be first, we need to provide
the IP address of the target system that we want to attack,
certainly the IP address of the gateway and lastly, the IP address of our own
system. So you can just go ahead and type show options and
you are presented with all the details that disciplinary mode is encompassing.
So you can see that we are going to have
to set the DHOSTS, as you can see here, which is the IP address of the Attack
system of our target system, the SHOSTS, which is the IP address of the gateway.
And then we could just go ahead and run the Exploit.
If you make a mistake and you mix up DHOSTS, we first of all,
we can just repeat the command that Metasploit will overwrite information.
Let's go ahead and set the target IP address.
Type set space, DHOSTS space and the target ID, we can go ahead and.
The IP address of the gateway in the same manner.
Hit enter.
Then we can go ahead and.
Type two options one more time and see if
our information is there so you can see that everything is set.
Then we can just go ahead and run the Attack, Bot, Exploit.
But first we have to run Wireshark.
So let's go ahead and type Exploit and run the Attack.
And you can see immediately if you're having
the Wireshark open at the same time, you can see that from the moment that we
started the ARP, the ARP poisoning, which is in progress, as you can see,
there is all sorts of microdevices going back and forth, as you can see.
As you see, there is a steady stream of air pockets going on.
They are telling the target system that
the gateways Mac addresses, as you can see.
Mac address of our own system.
But once we are satisfied, we can just go ahead and.
Press control C to end the attack in our terminal, so.
We're stopping the Attack and.
Now we can stop the capturing.
We can stop capturing.
On Wireshark, you can see in normal
network ARP poisoning, it's very easy to perform.
Usually when you are running by a
Wireshark while the ARP Attack is running, Wireshark is clever enough to realize that
there are contradicting their Big packets sometimes if packet says that the Gateway
IP has called the real Mac address of the Gateway occurred.
But then some packets say the Mac address,
the equivalent Mac address of your computer.
So these finding will not be
prominently advertised while you're going through this whole traffic.
But you can find this note if you go to analyze and then.
Expert information.
If you can see
in the Exploit information window that has been popped up, you can see that there is
the warning duplicate IP address configured.
As you can see this.
This warning can simply mean that one or
more of the systems in your network are not using IP, but static IPS.
And that two or more of them are now using the same IP address.
This is the result.
So this would then result in conflicting ARP packets.
On the other hand, if you're using TCP or
if you know that you properly set up your network without duplicate IP addresses,
then this note is a strong indicator that a Spoofing Attack is going on.
As you saw and as we mentioned earlier, it's very easy to perform such an attack.
But there are some counter measures that you can take.
You can work with static ARP ENTRIES.
This means you manually tell your system
not only the IP address of the gateway, but also the corresponding Mac address.
It can then simply ignore all information
that is flowing in via ARP package which could be stating anything else.
Microsoft recommends a solution which
would need to be performed after every system reboot.
Apparently there are more permanent methods, the permanent that you might have
trouble getting rid of the static entry later on.
On the other hand, striving to handle
static ARP entries in large company networks with
with thousands of mobile workstations, which is rather an unrealistic endeavor.
You can use dynamic or reinspection if it is supported by your Switch or Router
and you can use wireless, like, of course, for adhoc detection.
So that was all for this video.
I hope it was informative enough for you.
And when you're ready, you can go ahead and click on the next video.
What are you going to learn how to examine Tor Traffic with Wireshark?