3

The arpspoof command will spoof default_router_ip's MAC address on all victims in the subnet

arpspoof -i <NIC>  <default_router_ip>

How does it fool the router about the MAC addresses of victim hosts in the subnet?

Improve this question

2 Answers 2

Reset to default
3 
arpspoof -i <NIC> <default_router_ip>

Will tell all devices on the subnet of <NIC> that they should resolve <default_router_ip> to this machine instead.

Say your attacking box has eth0 IP 192.168.52.7 and the MAC address 00-14-22-01-23-45.

Say the router has IP 192.168.52.1 and the MAC address 00-14-22-01-02-03.

If you run arpspoof -i eth0 192.168.52.1 your system will constantly send out ARP replies stating 00-14-22-01-23-45 is the correct hardware address for 192.168.52.1.

Therefore when our victim, 192.168.52.100 asks for the MAC address of the default gateway 192.168.52.1, it gets 00-14-22-01-23-45 and routes all of its internet traffic to our attacking box instead.

Note that -t is optional, and is only used if you want to target one victim at a time (192.168.52.100 in our case). If not specified, all ARP caches on the subnet are attempted to be poisoned. If -t is specified, you can also specify -r so that traffic in both directions is captured. This then does not require two arpspoof commands to be issued.

Improve this answer
1
  • Thanks for the reply. Ettercap README shows there are some exceptions on OS such as LINUX KERNEL 2.4.x and Solaris. but there are workarounds.
    – pktCoder
    Commented Feb 16, 2016 at 14:49
2

Assume the router having an IP of 192.168.1.1. Our victim will have an IP of 192.168.1.9.

We will need to open two terminal windows now, as we need to tell the victim that it should send its packets to us instead of the gateway, and we need to tell the gateway to send packets to us, instead of the victim.

arpspoof -t 192.168.1.9 192.168.1.1

arpspoof -t 192.168.1.1 192.168.1.9

Now run Wireshark or tcpdump to start capturing packets.

It will continuosly send arp reply and thus update the arp cache table on both the victim and the router side.

Also its important to enable ip forwading for the packet to reach from victim to router and vice versa.

As the attacker will capture the packets on wireshark (because the destination ip of the packet won't match with attackers ip.)

Hence forward the packet to destined routerand vice versa.

Improve this answer
3
  • Thanks for the answer. This will work for a individual victim in a subnet. Wonder if it's possible to do it for all hosts in the subnet without repeating for each individual IP.
    – pktCoder
    Commented Feb 13, 2016 at 14:01
  • Try out ettercaps arpsoof.it can scan for all hosts and arpspoof all of. At last you always have an option of looking in the source code and write your own software.:-)
    – sourav punoriyar
    Commented Feb 13, 2016 at 14:03
  • Checked ettercap, according to thegeekstuff.com/2012/05/ettercap-tutorial, it appears that you do it one at a time. By the way, I am not doing anything evil, just try to use it in a legit proj.
    – pktCoder
    Commented Feb 13, 2016 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .