0

  • I have virtual machine windows connected to NAT network.

  • I also have kali linux virtual machine connected to same NAT network.

  • I have port forwarding disabled. cat /proc/sys/net/ipv4/ip_forward gives me 0.

I run the command : mitmf --arp --spoof --gateway 10.0.2.1 --targets 10.0.2.4 -i eth0 . then I go to windows virtual machine type the url and it still accesses the website. Why? I know windows's virtual machine's ip is 10.0.2.4 so its requests have to come to kali linux machine first. I have ip forwarding disabled. so request doesn't go anywhere. why does it still work and accesses the website?

Improve this question
0

1 Answer 1

Reset to default
1

This still works because MITMf automatically enables IP forwarding when using the --spoof option:

def set_ip_forwarding(value):
    log.debug("Setting ip forwarding to {}".format(value))
    with open('/proc/sys/net/ipv4/ip_forward', 'w') as file:
        file.write(str(value))
        file.close()
Improve this answer
9
  • What should I do to disable it?
    – Nika Kurashvili
    Mar 8, 2019 at 22:50
  • You could run without --spoof but then it's not a mitm, so I don't see what you are trying to achieve if you want to mitm your network but without ip forwarding?
    – Joe
    Mar 8, 2019 at 23:01
  • The thing why I decided to ask this question is because I didn't understand this: when target makes request, it first comes to middle-man(hacker computer), then it forwards the request to the router. Question 1) i didn't specify that target's mac_address for router has to change to my mac_address, i only specify router's mac address to change to my mac_address for target., but not vica verca. so what will happen after router returns response? does router return response to hacker or target without middleman?
    – Nika Kurashvili
    Mar 8, 2019 at 23:10
  • what do you think? When i was using arspoof command, i'd run two commands. but now with mitmf, i can only run one command.
    – Nika Kurashvili
    Mar 8, 2019 at 23:22
  • The router returns the response to the man in the middle. I would recommend further reading on the ARP protocol and how ARP-based MITM works to ensure you fully understand how the attack works
    – Joe
    Mar 8, 2019 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .