1

As stated in the title.

In my lab I am trying to arpspoof a so called "victim pc" that is using Windows 7.

I do arp spoofing with arpspoof, but once run arp -a on the victim I see that the gateway entry is not changed. Maybe because the entry associated with the gateway is set to static.

In a situation like this, there is no way to arpspoof the victim?

1

No. It is still possible at least so:

  • if the MAC of the gateway is also spoofed and the attacker finds a way to somehow destroy the original communication channel to the gateway
  • if the attacker finds a way to corrupt the gateway (f.e. somehow stoling the admin password of a cheap, embedded router)
  • if the attacker sits behind your gateway (f.e. by doing a little rewiring)

But the most trivial MITM solution (localnet gw spoof from a cracked client machine) made really impossible.

1

Even though it does make ARP spoofing a lot more difficult, it does not prevent other MITM attacks (not exhaustive):

  • Port stealing
  • DHCP race
  • DNS spoofing

Other less known techniques exist (STP Mangling for example). ARP poisoning is most widely known and used just because it is so simple to carry out. In case you encounter a switch with static arp entries, it may well pay off to try the other techniques. Please also refer to the following presentation for a complete list of MITM attacks: https://www.blackhat.com/presentations/bh-europe-03/bh-europe-03-valleri.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.