How to Use & Abuse the Address Resolution Protocol (ARP) to Locate Hosts on a Network « Null Byte :: WonderHowTo

When joining a new network, computers use the Address Resolution Protocol to discover the MAC address of other devices on the same network. A hacker can take advantage of ARP messages to silently discover the MAC and IP address of network devices or actively scan the network with spoofed ARP requests.Why Do We Need ARP & What Does It Do?For devices to communicate on a network, they need to be able to link two important pieces of information. The first is an IP address, which you can think of like a parking space that's available on a network. The router checks to see which space is available at any given time and assigns an IP address that isn't being used to any device that connects to the network.Because a different space might be available at different times, your IP address on a network may be different on any given day. Your IP address will also change each time you join a new Wi-Fi network, as the router behind that network will assign you an IP address according to however the network was set up.Don't Miss:Tactical Nmap for Beginner Network ReconnaissanceThe second piece of information needed to deliver information across a network is a MAC address. A MAC address is like the license plate of a vehicle and stays with your device the same way. While your IP address changes depending on the network you're connected to, your MAC address stays the same. Like the license plate of a vehicle, a MAC address remains unchanged as it's assigned different parking spaces on networks throughout the day.In our analogy of the vehicle parking in different parking spaces, we would need two pieces of information to locate our vehicle at any given time. The first would be a unique description of the vehicle, like the license plate, or MAC address, so that we know when we find it. The second is the parking space, or IP address, the vehicle is currently assigned, allowing us to both physically locate and verify we have the correct vehicle within all the possible spaces it could occupy.The MAC and IP address of devices on the network are linked together in a table called an ARP cache that's used to route messages across a network. To populate this cache, computers request the MAC address of other devices assigned a particular IP address on the network by sending them an ARP request. While all devices on a network receive and process these requests, only devices with the matching IP address will reply with their MAC.Don't Miss:Get Started Writing Your Own NSE Scripts for NmapARP requests are how computers on a network automatically request each other's IP and MAC address information. While essential for being able to communicate with other devices on a network, they can also be abused due to the fact that anyone can send an ARP request and include false information.ARP for ReconnaissanceTo understand why ARP is useful for recon, we can take a look at ARP requests inWireshark. In the capture below, I've listened in on traffic in public for about 60 seconds to discover ARP requests from local devices. These requests are incredibly simple, but provide the background information needed for the network to function.In these requests, we can see the simplified version of the message spelled out. Each request asks "Who is at this IP address?" and lists an IP address to reply to with the information requested. Whichever device is at that IP address replies with its MAC address, allowing an attacker to sit back and passively use ARP to identify which device is at a particular IP address. Moreover, MAC addresses can be used to look up the manufacturer of the device, meaning we can also start to guess about what kind of device is residing at that IP address.Looking at the structure of the ARP request in Wireshark, you can see that while there is a sender IP address specified, the target MAC address is set to 00:00:00:00:00:00. This is the broadcast address, meaning that all devices on the network will receive and process this request, but only reply if the "target IP address" of 192.168.43.132 matches that of the device receiving the request.We can use ARP requests to scope out a network in one of two ways, active scanning or passive discovery.Active vs. Passive ReconFor a hacker or red team exploring a network, active scanning can easily lead to being discovered. One of the safest ways to avoid discovery is to not do things that are clearly associated with attacks, like aggressive scanning of networks using tools that generates lots of suspicious traffic. ARP can be a gold mine when it comes to avoiding discovery in this way, and it can be used to locate nearly every device on a network without running a single scan.If the risk of discovery isn't too high, more active ARP manipulation can allow a hacker to map, reroute, and even disable a network in a matter of minutes. In the first phase of the attack, a hacker can send out ARP requests to every possible IP address on the network. After getting a list of every device out there, the hacker can send ARP replies to trick any device on the network into assigning the attacker's MAC address to the router's IP address, accidentally sending traffic meant to the router to the attacker's device instead.Don't Miss:Easily Detect CVEs with Nmap ScriptsThe hacker can either forward this traffic on to the router while sniffing or modifying the data that passes through or he or she can drop the traffic entirely. If the traffic is dropped, the device targeted will be cut off from the network, allowing the hacker to selectively capture the data connection of any device they discover by sending forged ARP replies.In this example, we'll explore two tools to discover devices with ARP that use both active and passive discovery.What You'll NeedTo follow this guide,Kali Linuxis the easiest system to use. You may be able to use these tools on other Linux systems, but I haven't tested them on anything besides Kali.You'll also need an Ethernet or Wi-Fi connection to sniff, although this will not work if you try in a public place that has a router which restricts you to your ownsubnet. If it does, the only ARP information you'll be able to obtain through active scanning will be the MAC address of the router.You should also note that you will needthe password to the networkif you're using a Wi-Fi connection. You can't do this from the outside of a network, you need the ability to send ARP messages on the network for active scanning or listening to other traffic.Recommended on Amazon:'IP Subnetting - From Zero to Guru' by Paul BrowningStep 1: Connect to the NetworkOnce you connect to a wired or wireless network, your computer will begin storing ARP information in an ARP cache. This is stored in the memory of your computer and gets added to every time an ARP reply is received to update your computer's address book of which devices are on the network and what their IP and MAC address are.You can access the information your computer has saved about your current network by opening a terminal window and typingarp -ato see your ARP cache.arp -a_gateway (192.168.43.1) at b2:72:bf:ee:15:42 [ether] on wlan0To start, I only see the MAC address and IP of the default gateway, which is the router. If you need to quickly find the router, this is a great way of doing so.Already, this gives us some useful information. The default gateway is at 192.168.43.1, so in order to impersonate the router, we could send an ARP reply to any device saying our MAC address is at that IP address.Without running any scans, let's see what we can learn about the network and which IP addresses are occupied by opening Wireshark and looking at ARP requests flowing across the network.Step 2: Open WiresharkThe first step to discovering devices on the same network is to simply listen in on the ARP requests that are automatically broadcast over the network. After opening Wireshark, select thenetwork adapterconnected to the network you want to monitor, and click the shark fin icon to start capturing.Don't Miss:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019Make sure to click "Enable promiscuous mode on all interfaces" in Capture –> Options –> Input if it isn't checked. This allows you to receive packets even if they aren't addressed to your device. To filter out packets that aren't ARP requests, typearpinto the display filter.So what are we seeing? The router is asking a range of IP addresses for their MAC address to see if a device is connected. We may not be seeing all of the replies, but we can see that our device is replying to the ARP requests by providing its MAC address. We may start to see replies answered, but to take matters into our own hands, we can send some ARP messages of our own.Step 3: Run an ARP ScanARP-scan is an extremely simple tool that allows us to craft ARP messages to discover devices on a network. It should be installed by default on Kali, but if you don't have it, you can install it withapt install arp-scan.In a terminal window, you can run the most simple ARP scan by typing the following, then watch the results in Wireshark. The commandarp-scan -lscans the local network even if we don't know the network range.arp-scan -lInterface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.2 e8:11:32:dc:39:80   Samsung Electronics Co.,Ltd
192.168.0.1 40:70:09:7a:64:97   ARRIS Group, Inc.
192.168.0.5 00:09:1b:0c:62:0f   Digital Generation Inc.
192.168.0.8 d4:95:24:c2:36:27   Clover Network, Inc.
192.168.0.6 10:8e:e0:ef:5d:f2   (Unknown)
192.168.0.11    3c:dc:bc:05:77:d4   (Unknown)

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.859 seconds (89.54 hosts/sec). 6 respondedIf we do know the network range, we can also use the commandarp scan 192.168.0.0/24to do the same or limit how many IP addresses we're scanning.In Wireshark, we can see the replies that have given us this information.This is a bit obvious though, isn't it? These packets are addressed to us, so it's pretty obvious to anyone looking at the packets that it's us running an ARP scan in an attempt to locate devices on the network. If that's not part of our job, this activity could get our MAC address blacklisted.If we look at the packets we intercepted, they're addressed to us. So how can we hide this?By adding the-sflag, we can specify a fake source for our ARP scan. This means we can pretend someone else is doing the ARP scan! Because we're not using our real MAC address, it means we won't be the MAC address on the packets being sent.To try this out, let's try to blend in with the ARP requests the router keeps sending. Using the router's IP address of 192.168.0.1, we'll do an ARP scan with the-ssource flag and-vverbose flag to display more output.arp-scan -l -s 192.168.0.1 -vInterface: wlan0, datalink type: EN10MB (Ethernet)
Using 192.168.0.0:255.255.255.0 for localnet
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.2 e8:11:32:dc:39:80   Samsung Electronics Co.,Ltd
192.168.0.5 00:09:1b:0c:62:0f   Digital Generation Inc.
192.168.0.6 10:8e:e0:ef:5d:f2   (Unknown)
--- Pass 1 complete
192.168.0.8 d4:95:24:c2:36:27   Clover Network, Inc.
192.168.0.11    3c:dc:bc:05:77:d4   (Unknown)
192.168.0.7 50:33:8b:68:2d:73   (Unknown)
--- Pass 2 complete

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.551 seconds (100.35 hosts/sec). 6 respondedAwesome! We've spoofed the router and discovered other devices on the network by sending ARP requests on behalf of the router. But we used our MAC address rather than the router's MAC address. Does it matter? Let's look at Wireshark.Wireshark has discovered what we're doing and ratted us out! Because our MAC address was used with another IP address on the network, Wireshark knows something fishy is going on and flags this as suspicious behavior.Instead, we can use an IP address that isn't currently in use to hide this behavior. If we run the same scan with an IP address close to the end of the range of possible IP addresses on the network, Wireshark won't flag the packets as suspicious.Step 4: Run a Stealthy Passive Scan with NetdiscoverNow that we've tried out ARP scan, let's try out another scanning tool that uses ARP. Netdiscover should come installed by default in Kali Linux, but if it doesn't, you can install it by typingapt install netdiscoverin a terminal window.To get started, let's take a look at the available options. We can review them by typingnetdiscover -helpin a new terminal window.netdiscover -helpNetdiscover 0.3-pre-beta7 [Active/passive arp reconnaissance tool]
Written by: Jaime Penalba <jpenalbae@gmail.com>

Usage: netdiscover [-i device] [-r range | -l file | -p] [-m file] [-s time] [-n node] [-c count] [-f] [-d] [-S] [-P] [-c]
  -i device: your network device
  -r range: scan a given range instead of auto scan. 192.168.6.0/24,/16,/8
  -l file: scan the list of ranges contained into the given file
  -p passive mode: do not send anything, only sniff
  -m file: scan the list of known MACs and host names
  -F filter: Customize pcap filter expression (default: "arp")
  -s time: time to sleep between each arp request (milliseconds)
  -n node: last ip octet used for scanning (from 2 to 253)
  -c count: number of times to send each arp reques (for nets with packet loss)
  -f enable fastmode scan, saves a lot of time, recommended for auto
  -d ignore home config files for autoscan and fast mode
  -S enable sleep time supression between each request (hardcore mode)
  -P print results in a format suitable for parsing by another program
  -N Do not print header. Only valid when -P is enabled.
  -L in parsable output mode (-P), continue listening after the active scan is completed

If -r, -l or -p are not enabled, netdiscover will scan for common lan addresses.To run the most basic passive scan, we can run Netdiscover in passive mode with the following command. Wait a while for the router and other devices on the network to send and reply to ARP replies, and you'll begin to see this list populate.netdiscover -pCurrently scanning: (passive)   |   Screen View: Unique Hosts

 9 Captured ARP Req/Rep packets, from 7 hosts.   Total size: 460
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.0.7     50:33:8b:68:2d:73      2      84  Texas Instruments
 192.168.0.2     e8:11:32:dc:39:80      1      60  Samsung Electronics Co.,Ltd
 192.168.0.1     40:70:09:7a:64:97      2     112  ARRIS Group, Inc.
 192.168.0.5     00:09:1b:0c:62:0f      1      60  Digital Generation Inc.
 192.168.0.8     d4:95:24:c2:36:27      1      60  Clover Network, Inc.
 192.168.0.6     10:8e:e0:ef:5d:f2      1      42  Samsung Electronics Co.,Ltd
 192.168.0.11    3c:dc:bc:05:77:d4      1      42  Samsung Electronics Co.,LtdAlthough we are gathering the same information, we are gathering the information in a way that is invisible from the perspective of someone monitoring network traffic.Step 5: Run an Active Scan with NetdiscoverIf we want to start mapping the network more quickly, we can run active scans with Netdiscover as well. Without specifying a network range, Netdiscover will actually go after pretty much every common network range, leading to longer scan times. This may not always be accurate as well. I noticed that Netdiscover scanned the /24 network I was connected to as a /16, which may cause it to take much longer or miss some hosts.You can also increase the amount of ARP requests you send with the-cflag. To run an active scan against the network using 20 ARP requests per IP address, we can runnetdiscover -c 20in a terminal window.netdiscover -c 20Currently scanning: 192.168.34.0/16   |   Screen View: Unique Hosts

 100 Captured ARP Req/Rep packets, from 7 hosts.   Total size: 5528
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.0.2     e8:11:32:dc:39:80     19    1140  Samsung Electronics Co.,Ltd
 192.168.0.1     40:70:09:7a:64:97     28    1568  ARRIS Group, Inc.
 192.168.0.5     00:09:1b:0c:62:0f     17    1020  Digital Generation Inc.
 192.168.0.11    3c:dc:bc:05:77:d4      6     252  Samsung Electronics Co.,Ltd
 192.168.0.6     10:8e:e0:ef:5d:f2      8     336  Samsung Electronics Co.,Ltd
 192.168.0.8     d4:95:24:c2:36:27     16     960  Clover Network, Inc.
 192.168.0.7     50:33:8b:68:2d:73      6     252  Texas InstrumentsARP Resolves Host Information for YouWhen exploring a new network, ARP is the perfect tool for discovering what else is out there. Whether it's through passive eavesdropping over the natural flow of ARP requests or actively forging ARP requests to pretend someone else is sending them, manipulation of ARP messages make more obvious or suspicious scans unnecessary. If you need to start learning the IP and MAC addresses of other devices on a network, let the protocol designed to do just that take care of the heavy lifting for you.I hope you enjoyed this guide to using ARP to discover devices on a network! If you have any questions about this tutorial on the ARP protocol or you have a comment, feel free to reach me on Twitter@KodyKinzie.Don't Miss:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Justin Meyers/Null Byte; Screenshots by Kody/Null ByteRelatedHacker Fundamentals:A Tale of Two StandardsHacker Fundamentals:The Everyman's Guide to How Network Packets Are Routed Across the WebHow To:Advanced System Attacks - Total GuideHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHow To:Build an ARP Scanner Using Scapy and PythonHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)How To:Control Network Traffic with Evil Limiter to Throttle or Kick Off DevicesHow To:Understand & Use IPv4 to Navigate a NetworkHacking Pranks:How to Flip Photos, Change Images & Inject Messages into Friends' Browsers on Your Wi-Fi NetworkTutorial:DNS SpoofingHow To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Networking Foundations:Basic IP Addressing (Part 2)How To:Enumerate NetBIOS Shares with NBTScan & Nmap Scripting EngineHack Like a Pro:How to Conduct a Simple Man-in-the-Middle AttackHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningHow To:Run an FTP Server from Home with LinuxNews:8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing HabitsHow To:Assign a Static IP Address in Windows 7Hacker Fundamentals:A Gentle Introduction to How IP Addresses WorkHow To:Use I2P to Host and Share Your Secret Goods on the Dark Web—AnonymouslyHow To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelHow To:Create an SSH Tunnel Server and Client in LinuxNews:Nextdoor Brings Private Social Networks to a Neighborhood Near YouHow To:Mask Your IP Address and Remain Anonymous with OpenVPN for LinuxHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Completely Mask & Anonymize Your BitTorrent Traffic Using AnomosHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:Bypass a Local Network Proxy for Free Internet