I have successfully done a MAC Spoofing Attack on my open (ad-hoc) network using the macchanger tool (OS: Kali linux).

I would like to know what are the common techniques to keep the connection alive (so, the way to keep the machine with the real mac out of the network) because, when I try to reconnect using the victim's machine (Windows 10), the Windows machine obviously kicks out my Kali host from the network.

  • 3
    You rebroadcast the spoof constantly. – schroeder May 22 '19 at 11:15
  • @schroeder let me understand it, please :). What do you exactly mean with "rebroadcasting the spoof constantly"? – catsking May 22 '19 at 12:59

MacChanger just changes the MAC. It is not meant to kick off another device on the network. The effect of having the same MAC as another device means that the 2 devices interfere with each other.

The simple way to ensure that the attacking device always "wins" the fight is to send an ARP broadcast at a faster interval than the legitimate device (e.g. every second). This way, when the legitimate device sends its ARP broadcast, the attacker quickly overrides it. Seeing these fast broadcasts is the primary way of detecting an ARP spoof attack.

To do this, you need one of the many tools available that perform MAC spoofing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.