In this video I'll show you another attack on ARP protocol, this time of type denial of service.
A hacker could launch this attack on any host wired or wireless for example on a mobile phone or on
an IoT device on the local network which he's connected to. This hack
will use arp spoofing just like the MITM attack we’ve seen in the last lecture, just that but this
this time the hacker will disrupt the service or host connection to make the websites or other resources
unavailable to the victim.
The anatomy of this attack is the same as of the ARP Man in the Middle attack
just that the hacker will drop any packets he intercepts
instead of routing them to the real destination like in the case of the Man in the Middle Attack. Let's
see the attack live. On Kali
I am opening a terminal and becoming root
sudo su and a hyphen
and I am starting bettercap
bettercap -iface and the name of the interface eth0. Let's
see the help f arp.spoof module again
and we notice arp.ban which can be on or off. This attack will use the same of module, named arp.
spoof,
but this time in ban mode meaning that the target connectivity will not work anymore.
Okay let's set the target: set arp.spoof.targets and the IP address of the windows
machine.
This will be the victim
192.168.0.113
net.recon module is required for arp.ban
So I'm going to start it.
If you don't start it explicitly bettercup will start to net.recon as a requirement when starting
arp.ban. So net.recon on! Before starting the attack let's see that the victim can communicate
normally on the LAN and on the Internet
ping.8.8.8.8 it's working and let's a website!
okay it's working ! Let's start the attack arp.ban on and we notice that arp.ban has been started
In fact arp.ban means arp.spoof without forwarding enabled, so intercepted packets are
not forwarded to their real destination. Let's return to the victim machine and see if the connection
still works;
and it's not working, the packets are intercepted by the hacker and dropped; and the website, I am refreshing
the page and it's not the loading!
and arp-a say and we notice that the hacker, the IP address that ends in 200 and the default
gateway have the sameMAC address. This is what are spoofing means. Again on the hacker machine I am
stopping the attack arp.ban off restoring arp cache of one target; let's see if it works: ping
.8.8.8.8 and it's working and that the web page is loading ! This is
how you perform a denial of service attack using Bettercap and ARP on your local network.