At home I have two laptops (running on Windows). With one laptop (attacking laptop) I try to get in the middle of the connection of other laptop (victim laptop).
To do this is run Kali Linux in a virtual environment using VirtualBox on the attacking laptop. In VirtualBox I bridged my build-in wifi adapter to the virtual environment (I have no external USB wifi adapter).
I use the following commands:
echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i eth0 -t 192.168.1.63 -r 192.168.1.254
After executing the commands above, I can see that the physical address of the 192.168.1.254 (the router) changes in the victim's laptop ARP tabel (using
The new physical address is the MAC address of the host OS of the attacking laptop (so not the MAC address of the virtual adapter that Kali Linux uses)!
Therefore, the victim laptop start sending information to the wrong MAC address. It looks like Kali Linux is not receiving any data of interest and also cannot forward the data.
As a result, the victim laptop loses its internet connection while Kali Linux should forward the ethernet traffic of the victim laptop to the actual destination.
1) Why does the MAC address in the ARP tabel of the victim laptop becomes the MAC address of the host OS of the attacking laptop, and not the MAC address of the virtual adapter used by Kali Linux? I think it has something to do with the briding of the virtual network adapter with the build in wifi adapter. Maybe there are details about the briding I do not understand?
2) What should I change in order to make this attack work.
In Wireshak I can capture some data but I cannot make anything out of it. It seems like Wireshark is also capturing the traffic of the host OS.
Thank you for any clarification!