How to Control Network Traffic with Evil Limiter to Throttle or Kick Off Devices « Null Byte :: WonderHowTo

If you find yourself with a roommate hogging limited data bandwidth with video games or discover a neighbor has invited themselves into your Wi-Fi network, you can easily take back control of your internet access. Evil Limiter does this by letting you control the bit rate of any device on the same network as you, allowing you to slow or even stop data transfer speeds for them completely.Generally speaking, the average user doesn't have much visibility over who or what is on their network, so anyone with the password can slip in and start using bandwidth. In other situations, a roommate or family member may be hogging all the bandwidth unfairly to play video games or stream videos. Some routers have web interfaces that allow you to set limits on each connection, but without the password to the router, this option may not be accessible.Don't Miss:Use & Abuse ARP to Locate Hosts on a NetworkEvil Limiter uses ARP spoofing to make devices send data to the attacking computer rather than the router, allowing us to send the data on to the router at whatever speed we like. Thanks to the way the ARP protocol works, it's possible to control the speed of any device on a shared network connection. However, because ARP spoofing only works on IPv4 networks, this tool won't be effective on IPv6 for now.Evil Limiter for HackersFor a hacker, Evil Limiter allows easy targeting of either one, a few, or all devices on a network. It's easy to cut the cord on the internet of a particular device at any moment, allowing for a convenient pretext for asocial engineeringattack. If a hacker wanted access to an employees-only area, they could identify the device of employees in the area they want to be, then limit the speed of their connection.Rather than showing up unannounced, a hacker could throttle the manager's data connection while pretending to call from the utility company to ask if the internet connection has been slow. When the manager finds the internet is indeed slow, the hacker simply asks the best time to send someone over to fix it, giving them a pretext to enter the building and preventing the target calling the real utility company.What You'll NeedTo use Evil Limiter, you'll need a Linux system like Kali or Ubuntu with Python3 or higher. While a powerful advantage of Evil Limter is that it can be run on networks even when you don't have administrator privileges, I recommend making sure you have permission to run the tool on any network you want to test it on.Evil Limiter uses the ARP packet to limit connection speeds which is present in IPv4 networks, but not in IPv6 networks. Because of this, IPv6 systems are out of reach of this tool, as mentioned before.Don't Miss:Understand & Use IPv4 to Navigate a NetworkStep 1: Install Evil LimiterTo installEvil Limiter, there are only a few commands to throw in a terminal window, seen below. When the required libraries finish installing, Evil Limiter should be installed and ready to run.~# git clone https://github.com/bitbrute/evillimiter.git
~# cd evillimiter
~# sudo python3 setup.py installStep 2: Connect to the NetworkNow, you'll need to connect to your target network. Afterward, you can run Evil Limiter by typingevillimiterin a new terminal window. You should see something like below.~# evillimiter

███████╗██╗   ██╗██╗██╗       ██╗     ██╗███╗   ███╗██╗████████╗███████╗██████╗
██╔════╝██║   ██║██║██║       ██║     ██║████╗ ████║██║╚══██╔══╝██╔════╝██╔══██╗
█████╗  ██║   ██║██║██║       ██║     ██║██╔████╔██║██║   ██║   █████╗  ██████╔╝
██╔══╝  ╚██╗ ██╔╝██║██║       ██║     ██║██║╚██╔╝██║██║   ██║   ██╔══╝  ██╔══██╗
███████╗ ╚████╔╝ ██║███████╗  ███████╗██║██║ ╚═╝ ██║██║   ██║   ███████╗██║  ██║
╚══════╝  ╚═══╝  ╚═╝╚══════╝  ╚══════╝╚═╝╚═╝     ╚═╝╚═╝   ╚═╝   ╚══════╝╚═╝  ╚═╝
                by bitbrute  ~  limit devices on your network :3
                                    v1.1.0

OK   interface: wlan0
OK   gateway ip: 192.168.5.1
OK   gateway mac: 84:██:██:██:██:1a
OK   netmask: 255.255.255.0

type help or ? to show command information.If you see this, Evil Limiter is installed, connected to the network, and ready to go.Step 3: View Available CommandsYou can explore the functionality of Evil Limiter by looking through the menu system and checking out the available commands. To do so, type a question mark in the terminal to pull up the help page.(Main) >>> ?

scan                          scans for online hosts on your network.
                              required to find the hosts you want to limit.

hosts                         lists all scanned hosts.
                              contains host information, including IDs.

limit [ID1,ID2,...] [rate]    limits bandwith of host(s) (uload/dload).
                              e.g.: limit 4 100kbit
                                    limit 2,3,4 1gbit
                                    limit all 200kbit

block [ID1,ID2,...]           blocks internet access of host(s).
                              e.g.: block 3,2
                                    block all

free [ID1,ID2,...]            unlimits/unblocks host(s).
                              e.g.: free 3
                                    free all

add [IP] (--mac [MAC])        adds custom host to host list.
                              mac resolved automatically.
                              e.g.: add 192.168.178.24
                                    add 192.168.1.50 --mac 1c:fc:bc:2d:a6:37

clear                         clears the terminal window.Step 4: Discover DevicesAs we can see above, the commands are straightforward. To find devices on the network, all you need to do is typescan.(Main) >>> scan

100% |██████████████████████████████| 256/256
OK   7 hosts discovered.The scan will pull up any other hosts on the network. Typehoststo show them all.(Main) >>> hosts

┌Hosts──────────────┬───────────────────┬──────────┬────────┐
│ ID │ IP-Address   │ MAC-Address       │ Hostname │ Status │
├────┼──────────────┼───────────────────┼──────────┼────────┤
│ 0  │ 192.168.5.1  │ 84:██:██:██:██:1a │ _gateway │ Free   │
│ 1  │ 192.168.5.2  │ 0c:██:██:██:██:f5 │          │ Free   │
│ 2  │ 192.168.5.4  │ 3c:██:██:██:██:6f │          │ Free   │
│ 3  │ 192.168.5.24 │ 60:██:██:██:██:78 │          │ Free   │
│ 4  │ 192.168.5.25 │ c4:██:██:██:██:2b │          │ Free   │
│ 5  │ 192.168.5.61 │ 8c:██:██:██:██:f5 │          │ Free   │
│ 6  │ 192.168.5.67 │ f0:██:██:██:██:b5 │          │ Free   │
└────┴──────────────┴───────────────────┴──────────┴────────┘In my example, seven devices have been discovered on the network, with one of them being the router. Now we have a target list with which we can block or limit access, so let's give it a try.Step 5: Limit or Block DevicesIf you want to limit every device except the router, you can list them off one by one after thelimitcommand. You'll also have to specify the speed you want to limit them to. In my case, I'll go with200kbitas the limiting speed.You could use thelimit allcommand to choose everything, but because you want to leave the router alone, type the commandlimit 1,2,3,4,5,6instead to begin limiting those specific devices. The amount of devices you list depends on how many you found.Don't Miss:Stealing Wi-Fi Passwords with an Evil Twin Attack(Main) >>> limit 1,2,3,4,5,6 200kbit

OK   192.168.5.2 limited to 200kbit.
OK   192.168.5.4 limited to 200kbit.
OK   192.168.5.24 limited to 200kbit.
OK   192.168.5.25 limited to 200kbit.
OK   192.168.5.61 limited to 200kbit.
OK   192.168.5.67 limited to 200kbit.Now that we've limited some devices, we can also select any devices we want to block entirely from accessing the network. I've found that sometimes Evil Limiter can be heavy-handed while limiting connections, and the result is that devices are limited so much they might as well be blocked.To block a device, type theblockcommand, then the number of any device you want to prevent from receiving data over the network.(Main) >>> block 3

OK   192.168.5.24 blocked.Tryhostsa second time. The majority of the network should be blocked or limited.(Main) >>> hosts

┌Hosts──────────────┬───────────────────┬──────────┬─────────┐
│ ID │ IP-Address   │ MAC-Address       │ Hostname │ Status  │
├────┼──────────────┼───────────────────┼──────────┼─────────┤
│ 0  │ 192.168.5.1  │ 84:██:██:██:██:1a │ _gateway │ Free    │
│ 1  │ 192.168.5.2  │ 0c:██:██:██:██:f5 │          │ Limited │
│ 2  │ 192.168.5.4  │ 3c:██:██:██:██:6f │          │ Limited │
│ 3  │ 192.168.5.24 │ 60:██:██:██:██:78 │          │ Blocked │
│ 4  │ 192.168.5.25 │ c4:██:██:██:██:2b │          │ Limited │
│ 5  │ 192.168.5.61 │ 8c:██:██:██:██:f5 │          │ Limited │
│ 6  │ 192.168.5.67 │ f0:██:██:██:██:b5 │          │ Limited │
└────┴──────────────┴───────────────────┴──────────┴─────────┘Step 6: Restore Normal ConnectionNow that you've caused chaos on the network, it's time to set things back the way they were. Fortunately, doing so is easy. You can choose to either restore devices one by one or runfree allto undo any limitations on network devices.(Main) >>> free all

OK   192.168.5.2 freed.
OK   192.168.5.4 freed.
OK   192.168.5.24 freed.
OK   192.168.5.25 freed.
OK   192.168.5.61 freed.
OK   192.168.5.67 freed.Runhostsa third time, and network access should be normal again for all devices.(Main) >>> hosts

┌Hosts──────────────┬───────────────────┬──────────┬────────┐
│ ID │ IP-Address   │ MAC-Address       │ Hostname │ Status │
├────┼──────────────┼───────────────────┼──────────┼────────┤
│ 0  │ 192.168.5.1  │ 84:██:██:██:██:1a │ _gateway │ Free   │
│ 1  │ 192.168.5.2  │ 0c:██:██:██:██:f5 │          │ Free   │
│ 2  │ 192.168.5.4  │ 3c:██:██:██:██:6f │          │ Free   │
│ 3  │ 192.168.5.24 │ 60:██:██:██:██:78 │          │ Free   │
│ 4  │ 192.168.5.25 │ c4:██:██:██:██:2b │          │ Free   │
│ 5  │ 192.168.5.61 │ 8c:██:██:██:██:f5 │          │ Free   │
│ 6  │ 192.168.5.67 │ f0:██:██:██:██:b5 │          │ Free   │
└────┴──────────────┴───────────────────┴──────────┴────────┘Evil Limiter Is Effective but AggressiveIn my tests with Evil Limiter, I found it to be an extremely effective if sometimes overbearing tool. On occasion, my attempts to limit a target would instead wholly block it, so be sure to test the effectiveness of this tool before using it anywhere important.One thing to keep in mind when using Evil Limiter is that ARP spoofing exposes your MAC address, so using this tool on a network is effectively telling everyone that your MAC address is the router. That leaves your MAC address in the ARP cache of every machine you're targeting, so make sure to spoof your MAC address before using this tool if you don't want to be leaving your machine's fingerprints all over the network.I hope you enjoyed this guide to using Evil Limiter! If you have any questions about this tutorial on ARP spoofing, leave a comment below, and feel free to reach me on Twitter@KodyKinzie.Don't Miss:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Fix Boost Control Device on Bosch Fuel PumpHow To:Kick People Off Your Wi-Fi Network Using Your Nexus 7How To:Intercept Images from a Security Camera Using WiresharkHow To:Land a Nitro RC planeHow To:Draw Kick ButtowskiHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHow To:Clean the throttle body on a Saturn S-series carHow To:Intercept Security Camera Footage Using the New Hak5 Plunder BugHow to Hack Wi-Fi:Stealing Wi-Fi Passwords with an Evil Twin AttackHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:Add a Data Traffic Meter to Your Nexus 5's Status BarHow to Hack with Arduino:Building MacOS Payloads for Inserting a Wi-Fi BackdoorHow To:Spy on Traffic from a Smartphone with WiresharkHow To:Create an Evil Access Point with MitmAPHow to Hack Wi-Fi:Creating an Evil Twin Wireless Access Point to Eavesdrop on DataHow To:9 Ways to Get People to Do What You WantNews:Save Me!News:The Wet Potato Race!How To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningHow To:Get Free Wi-Fi from Hotels & MoreNews:Tips on recording a kick drumNews:The Kick Ass Video Game!How To:Completely Mask & Anonymize Your BitTorrent Traffic Using AnomosHow To:Share Your Laptop's Wireless Internet with Ethernet DevicesResident Evil:AfterlifeNews:Alec Baldwin Kicked Off Plane for Playing Words with FriendsHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Use the Safe Color Limiter Effect in AvidGalactic Invasion:How to Make a Wireless Robot Rocket LauncherMastering Security, Part 2:How to Create a Home VPN TunnelNews:The World we don't seeNews:Vibrant Color Photography Challenge: Evil Gummy BearRIP:ScroogleHow To:Downgrade and Jailbreak Your iOS Devices Stock Firmware for the HolidaysHow To:Use Tortunnel to Quickly Encrypt Internet Traffic