Instructor: Welcome back.
In this video we're going to take a look at
cool way that we can actually perform ARP spoofing
or ARP poisoning manually.
We're going to do that using a huge library that comes
with Python 3 and that is called the Scapy Library.
Now Scapy allows us to manipulate different
networking packets and we can also send and receive
the packets as well.
Now, we could do something like this
with the help of a socket library, but that would be much
much harder because with the help of Scapy
we have all of the packets already predefined
and we can just craft them to our liking.
Now the same way that you can open Python inside
of the terminal
you can also open Scapy inside of the terminal
and this will allow you to write the code line by line.
So it'll take a few seconds to open this framework
and once it opens up you will see this Scapy banner
and then you will be able to run the commands right here.
Scapy works similarly to Python
so you can use the print statements to print hello world
for example, and it will also run debt code as well.
However, we are not going to use it for this.
We're going to use it to craft packets.
For example, there are ether headers inside
of a packet and to see all
of the fields that an ether header has, we can type ls
and then ether.
The same way we can do for the ARP packets.
For example, if I type ARP inside of the brackets
it'll give me all of the fields that an ARP packet has
and you can do that for any packet that you want.
For example, you can also do it for TCP packet
and it'll give you all the fields that the TCP header has
and then you can change each of these fields to your liking.
But as I already mentioned, the goal for this video is
for us to craft an ARP packet that will poison the ARP cache
of Windows 10 machine
and that will tell our Windows 10 machine
that we are the router.
So how can we do that?
Well, first, if you remember
we must know the MAC address of our Windows 10
machine to be able to send the ARP poisoning packet to it.
Now, we're not going to cheat
and check out the MAC address inside
of the command prompt on Windows 10.
We're going to get it using Scapy.
To do that,
we must send an ARP request that we request the MAC address
of the Windows 10 machine.
To do that, we must also send that request
to the broadcast MAC address, which if you remember means
that every machine on the network will receive that request
and then hopefully our Windows 10 machine will reply
with its MAC address.
So to do that, let me see if I can use
clear command right here.
Okay, great.
I can use it.
To do that, we are going to combine the ether header
that we just checked out
with the ARP header or the ARP packet.
The reason we need the ether header is
so we can specify the destination MAC field to
be the broadcast MAC address.
Therefore our ARP packet will be received
by anyone on the network.
Let's do that.
So let's create a variable called broadcast
and this variable will be equal to ether header
and the dst field, which is the destination,
We can set the broadcast MAC address
which is for everyone, six times ff, separated by two dots.
Once you do that, you can close the brackets
and now we've got our broadcast packet ready.
To check out whether everything is selected correctly
we can type broadcast.show and this will show all
of the fields that we have right here.
And you will notice
that it'll automatically set the other two fields.
This is the MAC address of our Kal Linux machine
which is the source MAC address
because we are sending the packet from our Kal Linux machine
and the destination is to who we are sending the packet.
In this case, we're sending the packet to everyone.
Now what we must do is we must also create the ARP layer
to this packet.
And to do that we can type ls ARP first to check out all
of the fields, and we want to target the Windows 10 machine
because we want to get its MAC address.
So what we must do is we must type the P destination to
be equal to the IP address of Windows 10 machine.
All the other fields will be set automatically
for us except this hardware destination field
which is the MAC address of our target
which we get from the R response.
So to craft the ARP layer
we can type ARP layer equals and then ARP.
And inside of the brackets we specify
the fields that we want to use.
In this case, we only specify the P destination to be equal
to 192.168.1.7, or you can just specify
the IP address of your target machine.
Press enter and before I explain this, I can just
type ARP.show to show you how the packet looks like.
So it'll select the hardware source to be our MAC address.
It'll select the P source to be our IP address.
It'll select the P destination to be the targets IP address
which in our case is 192.168.1.7
and the hardware destination will be empty
because this is the value that we want to get back.
This packet is essentially saying who has 192.168.1.7,
give me your MAC address.
And to combine this packet
with our broadcast layer, we can type
entire_packet equals
broadcast/ARP_layer.
And this will put our two layers together.
If I type entire_packet.show
you will see we have both the ethernet layer
and the ARP layer.
Only thing we must do right now is we must send this packet
to our network.
We can do that using SRP function
and this function takes arguments of entire packet.
We can also set a timeout to be two
and we can set the verbose to be equal to true.
Now this is not something that we want to send.
We want to store the response inside of the answer because
if the Windows 10 machine answers, we will have our answer
with the Windows 10s MAC address right here
in this variable.
We also want to only get the answers
and not the unanswered packets
and we can do that by specifying right here,
zero, to select the first element inside of the list.
Once we do that, we can press enter
and we get operation not permitted
and that could be because we are not route account.
So what I'm going to do is I'm going to
run this real quick as route.
So I'm just going to write all
of the commands that we just did and I will get back
to you as soon as you get to the SRP command.
Okay, so here we are.
Now we made a mistake that I already talked about.
We must run all of this as a root account
otherwise some of these commands will not work.
And I just typed all of the previous commands
that we did such as setting the broadcast layer ARP layer
and creating the entire packet.
And now we are sending the entire packet with this command
and we are storing the response in the answer variable.
So let's press enter
and it'll tell us finish sending one packets
received one packets back and got one answers.
Now to get this answer, it's a little bit tricky, so
if I type print answer, we will get this
response right here.
And since all of these are empty, we want to
select this other part right here and print just that part.
To do that, we can type print answer
and then the first element which will be the answer packets.
So in the brackets we specify zero, press enter
and this is our response from the Windows 10 machine.
If we take a look at the response right here
we're going to see the MAC address of Windows 10 machine.
So we successfully received it with our packet.
Now we can either copy it from here
and store it in a variable or we can select it like this.
So we're going to print the answer
and from the answer we are selecting the first element.
And from the second list we are selecting the second element
and we are going to type .hwsrc.
And the reason we are using hw src is
because this is the field that has the MAC address
of our Windows 10 machine or of our target machine.
Then if I print this
it should print just the MAC address and here it is.
And all we need to do right now is copy this
and store that in a variable
that we can name target MAC address equals
and then our answer with the hw source field.
Great. Now we got our targets MAC address
and we are ready to craft the malicious ARP packet.
So what we can do is we can type something like this.
The packet will be equal to ARP packet
and we are going to select the op field to be equal to two.
Now, if you type ls ARP, you're going to see the op field.
And this op field is simply just asking are we
sending ARP request or ARP reply?
Once we select the field to be equal to two
this means we are sending an ARP response.
And remember to send a malicious ARP packet.
It must be an ARP response telling the router
that we are Windows 10 machine or something similar to that.
Once we set the op to be equal to two
we must set the hardware destination to be equal to
target_mac_address.
And from here we are selecting two more fields
which are P destination to be the IP address of our target.
So this simply means
that we are sending this packet to our target.
And the last part is where we add the malicious thing.
Here under the P source in a real packet
in real communication
we would specify right here the IP address
of our Kal Linux machine, but in this case
we want to pretend that we are router.
So we're just going to specify the IP address of the router.
And this right here is our malicious packet.
If I type packet.show, you will see it right here.
We have the MAC address of our Kal Linux machine
but we also pretend to be the router.
We typed the router's IP address instead of our own.
And this packet is being sent to this destination.
Now, before I send it, I'm going to open the command prompt
on my Windows 10 machine
and I'm going to run the ARP dash a command
from the previous video just to see how the ARP
tables are currently being set.
So we can see that the router, which is in my case
192.168.1.1 has this MAC address.
Our Kal Linux machine
which is 192.168.1.10 has this MAC address.
And you will notice once they send this packet
this IP address, which is our Kal Linux
and the router's IP address will have the same MAC address.
And that is an indication that the ARPs proofing attack
is taking place at that specific time.
So let's send the packet.
And to do that, we can use the send function.
The first argument is going to be the packet
and we can set the verbose to be equal to false
and press enter.
If I go back to command prompt and type ARP dash a again,
we can see now router has the same MAC address
as our Kal Linux machine right here.
So we successfully ARP poisoned the ARP cache
of our target machine.
Now that we did this, you probably now
fully understand how ARP poisoning works
and you can also take a look
at different tools online to see
if there are some better tools that you can use to
perform man in the middle attack.
Some of them have more options
some of them have less options.
But nonetheless, this is all it is about this attack.
You simply just send a malicious ARP packets
and redirect the connection to you.
So thank you for watching this video
and I will see you in the next section.