I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines.

We set up IP Forwarding using:

echo 1 > /proc/sys/net/ipv4/ip_forward

This allows us to analyze communications using, for example, Wireshark. In theory, we should be able to modify traffic as well. I am aware of tools like Ettercap and SSLstrip, but how would I manually impersonate the target server?

To rephrase the question: client A is talking to server B. Attacker C (that's me) is in between and currently forwarding packets both ways. How does C, at a low level, redirect requests meant for B to my own machine?

All systems involved are using BackTrack.


My arpspoof commands (on attack machine, C):

arpspoof -i eth0 -t # Tell (A) that I am (B)
arpspoof -i eth0 -t # Tell (B) that I am (A)

My netcat commands for testing:

nc -p 5555 -l # Run on target B, listen on port 5555
nc -p 5555 -l # Run same thing on attack machine
nc 5555 # Run on A; connect to B.

My goal is to get C to pose as B when A runs the last command.

If IP forwarding is on, A connects to B. If IP forwarding is off, A fails to connect with: (UNKNOWN) [] 5555 (?) : Connection timed out. The issue is that the IP layer does not respond to a packet meant for another IP address; so although C receives the packet at a lower level, it does not get passed "up" the stack. My goal is to get this up the stack.

  • Are you asking how to do it using the tools? Or the theory on how the techniques works?
    – schroeder
    Jan 31, 2012 at 18:32
  • I was looking for the quickest way to do this sort of thing on BackTrack. From your answer, it looks like Ettercap may do more than I thought before; I will look at that some more. I think I understand the theory, but I may well be missing something.
    – jtpereyda
    Jan 31, 2012 at 19:53
  • the links I provided are tutorials for the tools
    – schroeder
    Jan 31, 2012 at 19:58
  • I'm using netcat for communication between A and B, and want C's netcat command to be used instead. So I want to do something like nc -l 5555 or nc -p 5555 -l on both B and C, then nc IPAddressForC 5555 and get a response from B rather than C.
    – jtpereyda
    Jan 31, 2012 at 19:59
  • Assuming you got the computer names mixed up in your comment, then arpspoof does exactly what you say. B and C are listening on 5555, A connects to IPAddressForB 5555 and gets C instead. C has overwrtitten A's arp cache to redirect A's communication to B to C's mac address.
    – schroeder
    Jan 31, 2012 at 20:19

2 Answers 2


This involves writing a bit of code, but the mechanism is pretty simple.

You write a program that listens for connections outbound from your target. Use typical socket programming techniques. As before, use ARP spoofing to get the traffic to your computer, and possibly DNAT rewriting if necessary so that your application recognizes the traffic if your network configuration doesn't jive with the inbound packets. Then you make a separate outbound connection to wherever the traffic was originally going. And simply parrot the traffic from one host to the other, monitoring and/or modifying as you go along, using SNAT if that's necessary for what you're trying to accomplish.

Alternatively, you can do some really cool vooodoo with libnetfilter_queue. Essentially what you do is set up an iptables rule that sends the traffic to the target QUEUE. You then write a userspace tool that receives those packets, makes whatever modifications you want, and then optionally pushes them back onto the network stack. This mechanism is way more elegant in a certain regard, but also fairly low-level. It works at the packet level, so for example all the magic TCP does for you may have to be accounted for in your code, depending on what you're trying to accomplish.

  • Thanks, this is a little bit out of my time frame for this experiment, but that is good to know. I guess this is why the pre-built tools exist. I haven't done much socket programming, but maybe that needs to change.
    – jtpereyda
    Feb 2, 2012 at 2:39

Once you have intercepted the communication, you can perform an edit on the plain text in the packets being sent, so you can change what a website says, for instance. A search/replace using regex works for this purpose.

To do this efficiently, ettercap has many tools to help you out.

Depending on what you want to accomplish, BeEF is another great example, which in included in Backtrack. It allows you to spoof entire websites and make modifications. It also has some impressive client attack tools, but I think that's not in the scope of what you want to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .