I am trying to execute an attack that requires a full-duplex MiTM position. This is the reason why I choose to use Ettercap. I have picked DHCP spoofing as the attack of choice.

The problem that I am facing is that Ettercap executes the attack as half-duplex, meaning that I can only intercept messages coming from the client. I also want to intercept the messages coming the other way i.e. I need a full-duplex MiTM.

From what I understand, Ettercap acts as a gateway router in this scenario. The client thinks that I am the gateway so it sends me a request whose destination is not on the subnetwork, expecting that I will forward the layer 3 packet appropriately. Ettercap does this. However, when the response is received by the actual gateway router, it sends it immediately to the client (victim) because that is where the request packet originated from (source IP). This is shown in Figure 1.

What I basically want is to stop Ettercap from doing anything after the initial DHCP spoofing attack. Then I will add my own script that will make the same request as the client did, effectively acting like a forward proxy. This way, when the response is received by the actual gateway router, it will be sent to me. Then I can change things as I like and forward the changed response to the client. This is shown in Figure 2.

enter image description here

I hope that everyone understands what I meant to say. Does anyone know how this can be achieved?

Thank you! Cheers.


So running a command like

ettercap -T -q -B <iface1> -i <iface2> //

will go into "full duplex" bridge mode where if you broke the link between two machines completely and plugged them into iface 1 and 2 the two machines would be able to talk to eachother just as before. However there is no mac spoofing so make sure if your using a switch or router it allows promiscuous traffic. You also need to make sure there is no direct connection between the gateway router and the client. from there you can do various things with filters. Though I havn't had much success with filters in bridge mode and wrote a plugin. You can alter any bytes you want and just set

po->flags |= PO_MODIFIED;

and the modified packet will go out the other interface.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.