I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines.
We set up IP Forwarding using:
echo 1 > /proc/sys/net/ipv4/ip_forward
This allows us to analyze communications using, for example, Wireshark. In theory, we should be able to modify traffic as well. I am aware of tools like Ettercap and SSLstrip, but how would I manually impersonate the target server?
To rephrase the question: client A is talking to server B. Attacker C (that's me) is in between and currently forwarding packets both ways. How does C, at a low level, redirect requests meant for B to my own machine?
All systems involved are using BackTrack.
My arpspoof commands (on attack machine, C):
arpspoof -i eth0 -t 126.96.36.199 188.8.131.52 # Tell 184.108.40.206 (A) that I am 220.127.116.11 (B) arpspoof -i eth0 -t 18.104.22.168 22.214.171.124 # Tell 126.96.36.199 (B) that I am 188.8.131.52 (A)
My netcat commands for testing:
nc -p 5555 -l # Run on target B, listen on port 5555 nc -p 5555 -l # Run same thing on attack machine nc 184.108.40.206 5555 # Run on A; connect to B.
My goal is to get C to pose as B when A runs the last command.
If IP forwarding is on, A connects to B. If IP forwarding is off, A fails to connect with:
(UNKNOWN) [220.127.116.11] 5555 (?) : Connection timed out. The issue is that the IP layer does not respond to a packet meant for another IP address; so although C receives the packet at a lower level, it does not get passed "up" the stack. My goal is to get this up the stack.