• I have virtual machine windows connected to NAT network.

  • I also have kali linux virtual machine connected to same NAT network.

  • I have port forwarding disabled. cat /proc/sys/net/ipv4/ip_forward gives me 0.

I run the command : mitmf --arp --spoof --gateway --targets -i eth0 . then I go to windows virtual machine type the url and it still accesses the website. Why? I know windows's virtual machine's ip is so its requests have to come to kali linux machine first. I have ip forwarding disabled. so request doesn't go anywhere. why does it still work and accesses the website?


This still works because MITMf automatically enables IP forwarding when using the --spoof option:

def set_ip_forwarding(value):
    log.debug("Setting ip forwarding to {}".format(value))
    with open('/proc/sys/net/ipv4/ip_forward', 'w') as file:
  • What should I do to disable it? – Nika Kurashvili Mar 8 '19 at 22:50
  • You could run without --spoof but then it's not a mitm, so I don't see what you are trying to achieve if you want to mitm your network but without ip forwarding? – Joe Mar 8 '19 at 23:01
  • The thing why I decided to ask this question is because I didn't understand this: when target makes request, it first comes to middle-man(hacker computer), then it forwards the request to the router. Question 1) i didn't specify that target's mac_address for router has to change to my mac_address, i only specify router's mac address to change to my mac_address for target., but not vica verca. so what will happen after router returns response? does router return response to hacker or target without middleman? – Nika Kurashvili Mar 8 '19 at 23:10
  • what do you think? When i was using arspoof command, i'd run two commands. but now with mitmf, i can only run one command. – Nika Kurashvili Mar 8 '19 at 23:22
  • The router returns the response to the man in the middle. I would recommend further reading on the ARP protocol and how ARP-based MITM works to ensure you fully understand how the attack works – Joe Mar 8 '19 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.