Hello guys!
I'll start a series of videos of how to hack the ARP protocol and launch
a MiTM attack to capture sensitive data.
I want to start with a disclaimer: do not use any of the information I teach you in this video and
in all my other videos related to network security and ethical hacking for malicious activities. Launch
the attacks shown in this course only on your network or on other networks that you have permission
to access. Let's
start with a short explanation of what ARP is and how it works. A good understanding or ARP is critical to
to deeply understand how this attack works.
ARP (or ARP) stands for Address Resolution Protocol and is one of the fundamental protocols used in
wired Ethernet and wireless networks. When a device wants to communicate with another device in a local
area network
it needs both the Mac and the IP address of the destination. The user that starts the application on
the source host uses only the IP address of the destination host. The destination MAC address remains
hidden to the user.
Just imagine that you want to ping a device on your land or you want to connect using http,
so the browser, to the local router or to other websites. In all these cases you'll use only the
IP address of the destination.
If you are not a networking engineer or a technical person you wouldn't even know that there is also a
MAC address involved. In a LAN
the packets go through a Switch or an Access Point and they take decisions based only on the MAC address.
The Switch or the Access Point looks for the Mac address of the pack it in the packet headers and
forwards it accordingly.
Let's look at an example!
I'll ping the internal interface of the router, which is the default gateway. Before launching
the ping command
I'll start wirehark to sniff the traffic.
I want to see all packets that are being transmitted and received.
I am starting wire shark: capture options
I am selecting the interface, WiFi, and start!
And I am pinging the default gateway ping 192.168.0
.1
okay ! It's working! As you can see I've used only the IP address of the destination and not the MAC address
as well
I'll stop capturing packets! If we take a look in wireshark at ICMP packets,
these are ICMP packets, and were generated by the ping command, we notice that they are both the IP and
the MAC address in the packet headers.
Let's take a look at this packet!
This is the source MAC address, the destination MAC address, the source IP address and the destination
IP address; somehow the source host should have found the MAC address of the destination.
And here is where ARP comes into play.
It works behind the scenes and finds the hardware address, also known as MAC address, of a host from its
own IP address.
Let's take a look again at the packets captured by wire shark.
And we notice these two packets; these two packs of type ARP.
This is an ARP request packet
and this is an ARP reply packet.
The ARP request packet is nothing about a broadcast packet sent over the network to find out the
corresponding MAC address of a given IP address,
the destination address.
We notice that these ARP request packet is destined to the broadcast address. The destination MAC
address is of type broadcast.
Being a broadcast packet means that it will be received by each host in the network and the message
says who has 192.168.0.1 tell
192.168.0.103 .1 was the destination,
so the IP address of the default gateway and .103 the IP address of windows. In plain
English it means: what is the MAC address of 192.168.0.1 wants to
know 192.168.0.103 Each host on the
network has received the packet but only the host with the IP address 192.168.0.1
has responded back with an ARP reply packet that contains its own
MAC address. This is the ARP reply packet and it says that 192.168.0.1
so the destination, has this MAC address. Now the source host which is
the Windows machine, knows both the IP and the MAC address of the destination and can build and then
send the ping echo request packets on the network; and we've seen the packet headers both the IP of the destination
given by the user and its corresponding MAC address found by ARP.
This is the destination MAC address found by ARP. Now after resolving the MAC address of the
destination ARP stores
the mapping between IP and the Mac in a table called ARP table for future reference; the subsequent
communications with the same destination IP address can use the same MAC address from the ARP table.
The source host will not repeat the process to find the MAC address of the destination. If you want
to display the ARP tabel you execute arp -a both on Windows and Linux.
This is the ARP table; you will see the mappings between IP addresses and the MAC addresses. For example
this is the mapping between the IP address of the default gateway and its MAC address found by ARP. If
you want to delete the entries in the ARP table you execute arp -d on Windows. To run this command
you need administrative privileges . Now the ARP table is empty. So this is basically how ARP works.
Now will take a short break and in the next lecture we'll talk about the Man in the Middle Attacks
and ARP poisoning!