ARP PoisoningESE 360By Raymond Talusan107731054

Table of ContentsDefinitionARP Spoofing/PoisoningMAC AddressMan-in-the-Middle AttackExamples of AttacksProcessInterceptionModificationDOS

Ettercap NgBackTrack (Linux)DefencesImportance

What is ARP PoisoningARP(Address Resolution Protocol) poisoning: an attack where the attacker (Eve) changes the MAC address of a machine.MAC Address(Media Access Control):Portrayed by 6 groups of two hexadecimal digits separated by colons or hyphens.They are associated with a network adapter and are linked to the hardware of network adapters unlike IP addresses.

Address Resolution ProtocolARP is the protocol that is used to convert an IP address into a physical address.The ARP Packet uses a message format that contains one address resolution request or reponseApplication for ARP Poisoning: We send these packets to the victim's machine informing it to associate with its own MAC address instead of the router which cuts off the communication between the router and the victim's device because the Victim's machine stops requesting from the router.

Tools Required Back|Track (If BackTrack is used the components below are not needed)EtterCap NGWiresharkIf not using EtterCap, you need scrapy,apache, and pythonSupportable OSPuTTY or other SSH Client

Ettercap NGEttercap NG is a tool that can be used for ARP Poisoning or other man-in-the-middle attacks. (In a Local Area Network)Program is available for most Linux Distributions, but supported in Debian, Fedora, Gentoo, Pentoo, FreeBSD, OpenBSD, NetBSDIt is also recently supported for Mac OSX(Snow Leopard & LionCan be run on Windows but will take extra configurationHas a Graphical Mode and a Terminal mode

BackTrackBack|Track is a linux distribution armed with preloaded instruments to be able to do digital forensics and penetration testing. This OS is not needed to do ARP poisoning but it has all security tools that you need built in so that you don't have to download anything else.

ProcessARP SpoofingARP TrafficARP TablesEnd SpoofingExecuting the Attack}These steps are to set up theMan-in-the-middle attack,butNo actual damage occurs.We also check to make sure theAttack worked.

Basic InterpretationSwitchRouterWebServerNetworkComputer 2Computer 1Each computer communicates with the Web Server directlyNormal Communication

Man-in-the-Middle AttackThis attack involes the attacker (Eve) to get in between an existing connection of machines to intercept, modify, or inject false data. This allows us to eavesdrop on a connection. AliceBobEveAliceBobEveDataOriginal DataModified Data

Basic InterpretationSwitchRouterWebServerNetworkVictim AliceEttercap UserEveBasically the the Attacker put's its machine in a logical position between the victim's machineAnd it's actual target to communicate with.Man-In-The-Middle Attack

ARP SpoofingMake sure you are connected to the LAN that your victim resides in. Lauch Ettercap Enter Sniffing Mode and Scan for hostsOpen up the host list and then select which device/computer we want to poison.

SniffingSniffing is to eavesdrop on computer communication between devices across Or in this case, within a network. This mode allows us to access network traffic

router

ARP PoisoningNow if we press Arp Poisoning and press Start sniffing. The program will modify the ARP tables for us.The program will change the targeted address of the machine in the table in to the attackers MAC address so that data being sent from the victim's computer goes to the attacker's computer instead of the associated router or other computer

AttacksAt this point, the victim's computer is now open to you attacks.DNS SpoofingSSH Downgrade AttackDOS Attack

DNS SpoofingDNS spoofing is an attack which causes the name server to return an incorrect IP address.For Example. Let's say the victim is a Stony Brook university Student. She/He accesses blackboard on a daily basis. After launching this attack we can make it so that when the user goes to: https://blackboard.stonybrook.edu/webapps/login/ It redirects to either another page or a script that you write. People use this attack for phishing purposes.

SSH Downgradehttp://www.openmaniak.com/ettercap_filter.php#ssh-downgrade-attack

DOS Attackhttp://www.securityexplained.net/topics/arppoison/dos/index2.html