Oh, yes.
There's plenty more to do.
There are several tools to perform an arpspoof attack such as Arpspoof, the command line tool which
is embedded in Kali.
But we're going to use Ettercap for the demonstration of the ARP spoof attack.
Ettercap is a.
Free and open source network security tool for man in the middle Attacks on land.
It works by putting the network interface into promiscuous mode and by ARP poisoning the target machines.
Thereby, it can act as a man in the middle and unleash various attacks on the victims.
Ettercap has both a command line interface version and a graphical user interface version.
Let's see them both in action.
First, let me show you the command line version of Ettercap.
So this is my network created in Genus three.
I have a collie, an Owasp BWA and a metasploitable VM in the network.
To use Ifconfig inside the VMs to check the IP addresses and the other interface configurations as well.
So pushing each other to be sure that they can communicate.
Okay.
Now I go to Cali, open a terminal screen and do the same here.
Check the interface configuration and ping other VMs.
Yep.
Everything's okay.
So let's look at the table of Metasploitable Type N and press enter.
So currently there are two records in the table of Metasploitable, one for Kali and one for Owasp BWA.
Now let me show you something.
If you want to perform an arpspoof attack, you should enable IP forwarding in your attacker system
so that the packets will not end on your attacker system and be forwarded to the destination system.
Otherwise you'll block the traffic between the victim and the spoofed system.
Check that out.
So the IP address is managed by a variable IP forward like in Kali.
And to look at the file content type.
Cat slash proc slash, cis slash.
Net slash ipv four slash IP Forward and press.
Enter.
Its value is zero.
So to enable it, it has to be one.
So I'll change it.
You can open the file with a text editor and change the value.
But here I'll just simply use the echo command for this purpose.
Echo one.
Greater than sign the entire file name.
So check the file again.
And yes, its value is now one.
Now, please note that Ettercap enables IP forwarding automatically even though you don't enable it
manually.
All right.
I want you to know what's happening behind the scenes, so to speak.
All right.
So now is the time of the attack.
Before creating the command, let's see the manual of Ettercap.
So, type man Ettercap and press enter.
So here's the short definition and the long description targets.
Options.
M for man in the middle.
MIT m attack.
So these are the mitm attack types.
ARP Is it the first line?
And the others?
ICMP, Dhcp, etcetera.
And here are the user interface options t for the text only interface.
Anyway, let's just create the command.
So first the command itself.
Ettercap i the interface E0T for the text only interface type.
M to make it a mint em attack and select a mint em attack type arp column remote.
So the first IP specifies the IP address which will be spoofed, and the second IP address is the victim
system.
So that means there will be a row in the Metasploitable ARP table with a Carly's Mac address and Owasp
Bue's IP address.
And that means when Metasploitable wants to send a packet to Owasp BWA, it will be sent to Kali instead.
Right.
And with the help of IP forwarding, the packet will arrive at Owasp BWA.
Finally.
Now, please don't forget to use these slashes at the beginning and end of each IP address.
The command is ready to run.
So let's see what it does.
Hit.
Enter.
And here's a summary of the attack.
The victims.
Interface type, etcetera.
Now we'll go to Metasploitable RPN to see the ARP table again.
And as you can see here, the first record is for Colley.
So please look at the Mac address.
And the second record is for Owasp BWA.
But with the attacker's Mac address, any packet sent from Metasploitable to Owasp, BWA will visit
Kali now.
So let's create a telnet connection to Port 80 of Owasp BWA.
Type.
Telnet Owasp, BWA IP and the port 80.
Now hit Enter.
Type.
Get slash http, slash 1.0 and press enter twice.
And here is the Http response, the main page of Owasp BWA.
Now let's go back to Cali and see what happens.
So these are all the TCP packets sent from Metasploitable to Owasp, BWA Act packet fin packet and scroll
up a bit and here's a Telnet connection.
Results.
Http Response.
Keep going up.
We can find some other critical data here too.
And here are some credentials, for example.
In the terminal screen where Ettercap is running.
You can use control C to end the attack.
So there it is.
It stopped.
Now go back to Metasploitable and look at the table again.
Now the IP address of Owasp BWA is matched with a correct Mac address.
Now, you might remember what I told you before that.
Well, I hope you remember everything that I told you before, but in particular, Ettercap has a graphical
user interface as well.
So let's have a look at Ettercap Gooey right now.
Again.
We're in Cali.
Click show applications, menu item and type Ettercap.
And here you go.
You'll find the Ettercap GUI app.
So these are both ettercap gooey apps.
You can just simply click one of them.
I want to show you, though, another way to start the app.
From the upper left corner.
Applications go to sniffing, spoofing tools and select Ettercap GUI.
Okay, so here we are at the main panel of the Ettercap GUI.
We'd better check the network.
So I'll open up a terminal screen and ping the other VMs, Metasploitable and Owasp BWA.
Yeah, everything looks okay.
So go to the sniff menu and ettercap and select unified sniffing.
Asking for input interface.
Eth0 is good.
Click.
Okay.
If you look at the Ettercap menu, it's totally different now.
So go to hosts and select scan for hosts.
It's a kind of a ping scan to find out the devices of the network.
It found five devices and added them to the hosts list.
So go back to hosts again.
And now select hosts lists.
And here's a list.
Very nice.
Works well.
192.168.10.11 is a wasp bwr.
So this is a system that will spoof, so I'll select it and click add to target to.
So.
192.168.10.12 is Metasploitable.
That's our victim.
So we'll change its ARP table, select it and click add to Target one.
I think now we're ready to attack.
What do you think?
All right.
So let's go to MIT and click ARP Poisoning.
Okay, check the sniff remote connections option and click okay.
And the final step.
Go to start and select start sniffing.
So the attack has begun.
Let's go to metasploitable and see the attack result to see the ARP table type arp n and press enter.
The first row is for Owasp BWA, but the Mac address is Carly's Mac.
To show it now, I'll ping Carly to create the ARP record.
Run the command again.
And now I have another row for Kali and both Kali and Owasp BWA of the same Mac address.
Okay.
You know the rest.
The packets will be sent to Kali instead of Owasp BWA.
So if you'd like, you can open Wireshark and collect the fruits of your labor.
Enjoy it.