Now that we know in detail how ARP works and how ARP Poisoning is performed let’s launch the attack!
The attack is possible on both wired and wireless networks.
My set up in this video is to launch of the attack on the wireless network and I have a Linux Mint
installed in a VM on Windows 10; it's important that the WiFi network to be set to bridge mode.
So in Virtual Box or in VM go to networks and check that it's attached to the bridged adapter.
In this lab
I'm going to use a tool called Ettercap, which is the default tool used to attack ARP.
Other interesting tools that to do the same are: ARP spoof, Man in the Middle framework or Bettercap.
We'll take a deeper look at Bettercap, which is an advanced hacking tool, in the next lectures. You'll
find Ettercap in Kali Linux already installed
or we can install it on any other Linux distribution.
It's a common security application that belongs to the standard repositories.If you don't use Kali
and use Ubuntu to our other similar distribution
you can install it using apt
This is Linux Mint which is based on Ubuntu and I'll show you how to install Ettercap just in case
you don't use Kali. There are both a text only ana a GUI enabled version of Enttercap. As root I am executing
apt search ettercap
This is at ettercap GUI enabled executable and this is the text only version. In this video I'll use
that text only version. Maybe you want to run Ettercap from a machine that doesn't have a graphical
interface installed or yau are connected using ssh on the machine where you want it to start. And
to install it I run apt install ettercap-text-only
Perfect, it has been installed! In this attach I wanted to poison the ARP cache of both the router
and the Windows machine which I use to record this video.
It will be the victim ; the IP address of that out there is 192.168.0.1
and the IP address of Windows is this 192.169.0.103
Okay I am executing the attack ettercap-T-
M ARP / the victim 192.168.0.103 //
and the default gateway.
In fact this is the second victim. I am not hitting enter yet. I want to explain to you some things:
-T means text only interface and the - M means Men in the Middle Attack of type ARP poisoning.
This option will activate the Men in the Middle Attack which is totally independent from the sniffing.
The aim of the attack is to hijack packets and redirect them to ettercap; then the sniffing engine
will forward them to the real destination. Everything will be transparent to the victims. Before starting
the attack let's see if the ARP cache of the victim arp-a and we notice the ARP and the MAC address
of the router but there is not the Linux IP and MAC address, that's because it hasn't learned it yet.
and I'll ping the Linux machine to generate an ARP request and reply packets so it will learn the MAC address
of the Linux machine: ping and the let's see the IP address of Linux: ifconfig
Okay.
This is the IP address of Linux and I am pinging it!
Let's check the ARP table again! Perfect; it has learned the MAC address of Linux!
This is the IP address of the default gateway and its MAC address and the the IP address of Linux
and its MAC address. Let's start the attack! I am hitting the enter key!
ARP poisoning victims and starting unified sniffing ! It has started the unified sniffing
which means it will sniff all the packets that pass on the medium! Note that I had some issues with
Kali Linux so if you get this error try to install another Linux distribution, like Ubuntu or Linux Mint,
and see if it works.
Please get in touch with me if you don't make it to work and I'll assist you with this! Let's return
to the attack. We suppose that everything runs smoothly and we move ahead. I'll go to Windows and
see the ARP table again.
And surprise! We notice that both the default gateway and the attacker have the same MAC address
saved in ARP cache. This is the MAC address of the attacker in the previous arp-a command
and the same MAC address is bound to both the default gateway and the hacker.
This is what ARP poisoning does!
The ARP cache has been poisoned! Now let's visit a website from the victim machine.
I have chosen wulnweb.com which is a site that hosts intentionally vulnerable applications to understand
how programming and configuration errors lead to security breaches.
It was created for the purpose of manual penetration testing or for educational purposes.
Feel free to use it to test how ARP poisoning works! And I'll access the last url which is in fact
a blog and then on log in.
I'll try to log in! Back to the hackers computer
I'll start Wireshark ! Capture- options-the interface and start And on the victim machine
I log in to that website: hacker and the password will be test 1 2 3 4 and I am clicking log in.
The authentication was not successful but this is not important at this moment.
Let's move to the hackers machine and see the intercepted traffic!
I'll stop capturing packets.
These are the packets sent between the victim and the website and there should also be the credentials
I've just entered. I am filtering for http packets.
We notice that this isn't an encrypted connection; it's using http and not https. Let's click on an
http packet with the mouse right button and then follow and a http stream; and in this window we
see the http packets sent to between client and server which contain also the user name and password.
Look here!
User name hacker password test
234 okay!
We have successfully launched this Man in the Middle Attack and captured sensitive data.
My advice to you is to never use unencrypted connections like http, telnet, smtp ot ftp.
This is an unencrypted connection.
It's not secure.
A malicious user could sniff your traffic and sensitive data very easily. To stop the attack
you press on Q in the terminal where Ettercap is running and it's simply re-arping the victims; you've
just learnt how to launch ARP spoofing attacks of type Man in the Middle on any wired or wireless
network.
In the next lecture we'll dive deeper into ARP spoofing and I'll show you other advanced hacking tools
and how to bypass a https and sniff encrypted traffic.
See you in a few seconds!