How to Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP Poisoning « Null Byte :: WonderHowTo

When your computer first connects to a nework, it sends out a request on the network to lease an IP from the router. The router then leases your computer an unused IP address, which is used as a unique routing address for sending traffic that is meant foryou, to you. As everything tends to, this method has its flaws.When you're on a network, local attackers can perform what is called aman-in-the-middleattack. When performing the attack, it makes it possible to sniff traffic and intercept unencrypted data, like passwords or email messages. So if you are one of the many people who do not useanyform of cryptographic protocol when you browse public internet, your data is open to analysis, among other things. An attack can succeed only when the attacker can impersonate each endpoint to the satisfaction of the other—it is an attack onmutual authentication. Most cryptographic protocols include some form of endpointauthenticationspecifically to prevent MITM attacks. For example,SSLauthenticates the server using a mutually trustedcertification authority.To perform this locally, we need to spoof ourselves to look like our router and start requesting traffic from another computer on our network. In order to trick another computer on our network into sending their traffic to ours, we need to ARP poison. This will make the target computer believe we are the default gateway and that it should be sending its traffic through us. After, we route the traffic to the actual default gateway and the gateway will send traffic back that we can forward to the victim. Everything appears to be normal and working on both ends.ARPorAddressResolutionProtocol is a method of letting the network map out IPs rather than giving each computer a table of the mapping. It is vulnerable to poisoning because there is no method of checking the authenticity of ARP replies built-in to the protocol. Thus, replies can be spoofed from other addresses on the network.WarningsI'm serious when I say, "Do this on your home network". Anyone with a decent intrusion detection system can easily detect an ARP poisoning attack by analyzing the packets logically. Why would a computer on the network be requesting and sending out ARP reply frames asking for another computer to connect to it? A friend of mine was in college and was poisoning the network and was caught within 10 minutes (they claim they used triangulation, but who knows).RequirementsLinux OSAdmin or root privilegesAt least two computers on your home networkStep1Download & Install the ToolsetText inboldmeans it is a terminal.We need to gather all of our tools needed to demonstrate this technique on ourselves.Obtain the following packages from your repository:dsniffiptablesettercapnmapTo Install the packages:Extract the packages.tar zxvf <package name>Configure the packages for compilation../configureCompile and install.sudo make && sudo make installStep2ARP Poison & Run EttercapGet your wireless card into monitor mode, so you're capable of sniffing traffic.sudo ifconfig wlan0 down && sudo ifconfig wlan0 mode monitor && sudo ifconfig wlan0 upNow we need to scan the local network for our target IP. This means we are pinging everyone on the local network and when we get replies, we can see their IP and pick them as a target.sudo nmap -sP 192.168.1.0/24Next, enable IP forwarding so we can foward our target computer's traffic.sudo echo 1 > /proc/sys/net/ipv4/ip_forwardIn order to forward the traffic properly, it needs to be rerouted to a port that we can listen on before forwarding.iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 1024It's time to ARP poison your second computer to make it send traffic to you.sudo arpspoof -i [interface] -t [router ip, target ip]Finally, set up ettercap to capture traffic between you and the client.sudo ettercap -Tq -i wlan0 -w ~/Desktop/capWhen the target computer sends enecrypted data across the network (non-HTTPS websites), ettercap will see it and dump the packets into the file "cap" on the Desktop. Examine the packets with a hex editor. Any unencrypted information will be displayed in hexadecimal, which is essentially an easy way to convery binary digits into hexadecimal, and hexadecimal to ASCII, which is readable to normal humans. I usedwxHexEditor. As you can see, the "hidden" data can be seen in plain text on the right side when opened.It can happen easily, but can also bethwarted in a pinchusing Tor as an encrypted connection to the internet.If you have any questions, please consult with users of theIRCchannel, they are the Null Byte Sages. Please, follow me onTwitterif you like reading and want the latest articles as they come out.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage viaTGDailyRelatedHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHacker Fundamentals:The Everyman's Guide to How Network Packets Are Routed Across the WebHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHow To:Use & Abuse the Address Resolution Protocol (ARP) to Locate Hosts on a NetworkHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Hack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHow To:Hack LAN passwords with EttercapHow To:Hack SSL passwords with ARP poisoningHow To:Advanced System Attacks - Total GuideHacker Fundamentals:A Tale of Two StandardsTutorial:DNS SpoofingHack Like a Pro:How to Conduct a Simple Man-in-the-Middle AttackNetworking Foundations:Basic IP Addressing (Part 2)How To:Intercept Images from a Security Camera Using WiresharkHacking Pranks:How to Flip Photos, Change Images & Inject Messages into Friends' Browsers on Your Wi-Fi NetworkReal Scenarios #2:The Creepy Teacher [Part 1]How to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow To:Control Network Traffic with Evil Limiter to Throttle or Kick Off DevicesNews:8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing HabitsNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:How Hackers Steal Your Internet & How to Defend Against ItWeekend Homework:How to Become a Null Byte Contributor (2/24/2012)Scrabble Bingo of the Day:URUSHIOLIPsec Tools of the Trade:Don't Bring a Knife to a GunfightHow To:Get Free Wi-Fi from Hotels & MoreMastering Security, Part 2:How to Create a Home VPN TunnelNews:Poison Ivy Clothing