Hello everyone in
this video. We are going to see how we
can use nmap to spoof Mac addresses
during our scan to stay
anonymous.
The syntax of doing this particular scan is
and map the target IP address followed by
- spoof - Mac, there are
various options that we can use to use
a custom Mac address to choose a random Mac
address and to specify the default Mac
addresses of different vendors.
You can scan a Target by simply giving IP address
and specify The Hyphen hyphen spoof Mac
flag to smooth the MAC address and stay anonymous.
You can always add hyphen V to see
the output and verbose mode the example of doing this scan
is shown below.
So it is the Practical time and let's see how you
can spoof your Mac address while performing a
scan and stay anonymous.
All right, as you can see over here, you can
specify the MAC address from a vendor. So let's
say you want to spoof your Mac address from Dell.
apple or 3 com
you can just specify Del and end map
will automatically take the vendors starting
prefix and it will
spoof the MAC address.
You can also generate a random Mac address
if you want with specifying zero
at the end of - spoof -
Mac.
In case you want to give your own custom Mac
address.
You can also do that.
By giving the custom Mac address as you
can see over here.
Remember the MAC address that you give should be this much
bits long. It should be 1 2 3
4 5 6 7 8 9 10 11
12 with long followed by
hexa decimal interpretation
And they should be colon in between.
So what we are going to do right now is we are going to give a
MAC address to the device. So as
you can see over here, I'm giving the
command which is nmap and then -
s t to do a TCP scan followed by
hyphen PN - spoof - Mac. I
am saying Del
And also I am taking a custom Mac address
for this particular Target when I'm
going to scan this.
So, let's see here. And you can
see I'm just giving the custom Mac address
over here and I'm going to scan my Local Host
computer.
Important thing to remember over here you have to specify the
particular interface that
you are going to use for performing this can as
you can see I'm using the et80. So
I have specified that using hyphen e
if you want to know which interface your computer
is using just type if
config or ipconfig for Windows
and you will be able to know and check
the interface that you want to use first spoofing
the MAC address.
So I'm going to take this particular Mac address, which is 0
0 0 1 0 2 25 56 a
this is just a random Mac address
that I have used.
And I will hit enter.
Before hitting enter what I have done is I
am running Wireshark to capture.
The request the packets and you can see the
filter that I have used is eth.addr instead
of IP address this time.
We want to see The Ether address which is
the MAC address and you can see I have already specified the
MAC address over here. So in case there
comes any request to this particular machine that
we are going to scan it will automatically tell me
that there is an incoming packet with this
particular Mac address.
As you can see I have started the packet capture already. I
will just hit enter and you can see I have
initiated a pink scan which means I am
performing a ping.
To see if the host is up or not. You can
see here. I have received the icmp request
which is because of the pink and let's see if this
is the MAC address that we have received. Perfect. As
you can see we have received our new
spoofed fake Mac address into
the Wireshark.
Which means the machine that we scanned received the
fake Mac address instead of the correct Mac
address.
now I will just type ifconfig to show
you the correct Mac address of the
network adapter of ET 0 the
ethernet adapter that we used and you
can see the MAC address was
this is the same IP address and this is the same and this is the
MAC address that was used.
0 0 0 c 2 9 3 0 3 7 8 6
the original Mac address but the MAC address that we
received the request was from this particular Mac
address, which is the fake Mac address.
That we specified during our scan.
So this is how an attacker can spoof
the MAC address and the receiving.
Victim will see okay. The scan is coming from
this particular Mac address, which means it is a Dell
device. It is a Apple device. Also, what you
can do is you can take
different Mac addresses of different computers. There
is also our website online where you
can generate fake Mac addresses and use those Mac
addresses to scan the particular Target.
So I hope you guys understood how you can evade
the IDS and firewall. Sometimes
if your Mac addresses are blocked for performing
the scan like this and you can
stay Anonymous without revealing your original
and correct Mac address.
I hope you guys understood. Thank you.