Backtrack 5 - ARP Poisoning

ARP Poisoning 

ARP Protocol

ARP is a layer 2 protocol link. ARP protocolwill be responsible for obtaining physical MAC addresses from IP addresses.In this type of network is necessary to know the destination MAC so that only the packet reaches the corresponding network interface and not another.

As noted, the concept of ARP only makes sense if we are in the field of switched networks, otherwise it would not be necessary to know the destination MAC in the network.

ARP Poisoning

The ARP poisoning, also known as ARP Poisoning or ARP Poison Routing is a technique used to infiltrate a LAN.

How does it work?

The principle ARP poisoning is to send fake ARP messages (spoofed) to the Ethernet. Usually the aim is to associate the attacker's MAC address with the IP address of another node (the node attacked), such as the defaultgateway (gateway). Any traffic to the IP address of that node, will be mistakenly sent to the attacker, rather than to its actual destination. The attacker can then choose among forward traffic to the actual default gateway (passive attack or listening), or modify the data before forwarding (active attack). The attacker can even launch an attack DoS (Denial of Service) against a victim by associating a nonexistent MAC address with the IP address of the default gateway of the victim.

Defense methods

• A method to prevent ARP spoofing is the use of static ARP tables, ie add static ARP entries, so that there is no dynamic cache, each table entry maps a MAC address to its corresponding IP address. However, this is not a practical solution, especially in large networks.
• In large networks it is preferable to use another method: the DHCP snooping. Using DHCP, the network device keeps track of the MAC addresses that are connected to each port, so that quickly detects if it receives a ARP spoofing. This method is implemented in the network equipment manufacturers such as Cisco, Extreme Networks and Allied Telesis.
• Arpwatch is a Unix program that listens on the network ARP replies, and sends an email notification to the administrator of the network, when an ARP entry changes.
• RARP ("Reverse ARP" or reverse ARP) is the protocol used to access, from a MAC address, your IP address. If response to a question, RARP returns more than one IP address, it means that MAC address has been cloned.

Video Tutorial:

Commands Back | Track: 

echo 1> / proc/sys/net/ipv4/ip_forward 
iptables-t nat-A PREROUTING-p tcp - destination-port 80-j REDIRECT - to-port 1000 
sslstrip-p-l 1000 / another window 
tail-f sslstrip.log 
arpspoof-i wlan0-t IP - Door link