basics 3 - tutorial ARP cache poisoning

This article is a tutorial for the classical ARP cache poisoning attack, on layer 2.
French version available on the site.

chose the target

	IP address	MAC address
serveur linux	192.168.0.2	00:0C:29:35:6A:41
client Windows	192.168.0.10	00:0C:29:B9:D2:02
intrus	192.168.0.12	00:0C:29:22:93:12

Remark: to know the MAC address: you can do:

intrus$ ifconfig eth1

ARP table on target machine

create a connexion between client and server to fill the ARP tables

client Windows > ping 192.168.0.2

Have a look to ARP cache on serveur linux and client windows:

client windows >arp -a

Interface : 192.168.0.10 --- 0x2
Adresse Internet Adresse physique Type
192.168.0.1 00-50-56-c0-00-08 dynamique
192.168.0.2 00-0c-29-35-6a-41 dynamique
192.168.0.12 00-0c-29-22-93-12 dynamique

ARP cache poisonning

Install ettercap:

intrus$ sudo apt-get install ettercap-gtk

use tutorial reference  [10]

Result:

result of ARP cache poisoning

Have a look again to ARP tables of targets

client windows>ping 192.168.0.2

Envoi d'une requête 'ping' sur 192.168.0.2 avec 32 octets de données :
Réponse de 192.168.0.2 : octets=32 temps<1ms TTL=64
Statistiques Ping pour 192.168.0.2:
Paquets : envoyés = 2, reçus = 2, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
Minimum = 0ms, Maximum = 0ms, Moyenne = 0ms
Ctrl+C

client windows>arp -a

Interface : 192.168.0.10 --- 0x2
Adresse Internet Adresse physique Type
192.168.0.1 00-50-56-c0-00-08 dynamique
192.168.0.2 00-0c-29-22-93-12 dynamique
192.168.0.12 00-0c-29-22-93-12 dynamique

On serveur:

The tables have been modified. Intrus is now in MAN IN THE MIDDLE place between serveur and client windows.

ARP protocol

Use Wireshark. As a result, you obtain lots of ARP requests:

Analyse different fields of several requests:

Result:
- ARP protocol is a layer 2 protocol (OSI model),
- Ethernet trames are sent by hub (192.168.0.1),
- They are broadcasted on every MAC addresses,
- because of that, hub tells address  192.168.0.9 who it is (this address is not attributed).

attack explanation

Ettercap sends continuously ARP requests to associate each target IP to intrus MAC address. As a resutl, targets update their ARP tables with datas given by ettercap.

The leak highlighted there is the lack of authentication in ARP protocol. In layer 2, it is impossible to know who speaks to who.

references

9) tutoriel ettercap - http://openmaniak.com/ettercap_arp.php
10) documentation ettercap ubuntu - http://doc.ubuntu-fr.org/ettercap