2

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via VMPlayer. The attack machine is on a NAT interface to enable access both to the internet and the targets, which are on the host-only network. These networks are virtual networks via VMPlayer.

Netdiscover does not seem to find the IP addresses of the target machines (using sudo netdiscover -r 192.168.0.0/16). The only IP's returned are the VMWare virtual network cards. However, when I simply ping the IP, or use NMAP, I find that the host is up and responding (I am able to find the IP by logging into the target directly and using ifconfig, but obviously in a real pen test you cannot do that).

I realize I could use NMAP to scan the range of IP's, but it's slow, and I have successfully used Netdiscover in the past.

What could I be doing wrong?

|improve this question
  • you need to explain what your network setup looks like - have you run a packet capture to see if the netdiscover packets are leaving the host? – schroeder♦ Nov 11 '15 at 18:03
  • Network is a VM Player default; good idea to run Wireshark and make sure the netdiscover packets are making it all the way, but PING, NMAP, OpenVas, and Nessus are having no problems finding the target... – Stone True Nov 11 '15 at 18:10
  • When you say that you have used Netdiscover in the past, has it been in this kind of setup? I have not used Netdiscover as a nmap alternative but as a wardriving/ARP probe tool. – schroeder♦ Nov 11 '15 at 18:13
  • 1
    on netdiscover's web page, it talks about specifying the interface (-i) - have you done this? – schroeder♦ Nov 11 '15 at 18:16
  • Identical setup on a different host PC. My goal in using Netdiscover is solely to find open IP addresses, not as an nmap alternative. As mentioned, using nmap to find open IP addresses seemed very slow, but I have not explored the nmap options to see if there are option flags that would simply find open IP addresses quickly. However, I still would like to know why everything EXCEPT netdiscover seems to work... – Stone True Nov 11 '15 at 18:16
7

Netdiscover finds IP addresses using the Address Resolution Protocol (ARP), which matches IP addresses to MAC addresses. However, ARP by design will not cross network boundaries (see for example at https://superuser.com/questions/1003990/vmware-nat-not-populating-arp-with-ip-mac-from-vmware-host-only). Therefore, there is no response to the ARP requests from Netdiscover from machines that are on the host-only network when a query is sent from the NAT network.

NMAP and Ping use different protocols which are supported across the virtual network. This answer was confirmed by using Wireshark and then placing the attack machine on the same host-only network. When the attack and target machines are on the host-only network, Netdiscover worked fine.

The issue is not with Netdiscover, but with the virtual network. This issue turned out to be virtual networking and not information security, but other security testers may have similar concerns as they work on virtual networks, therefore answered here.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.