ARP spoofing
Now that we have an understanding of spoofing attacks and why they are useful, let's start by getting in between some host conversations. I will use ARP spoofing to accomplish this. Using the arpspoof command, I will be able to poison the ARP cache on both sides with my MAC address to force a change in the traffic flow.
To work with Arpspoof, you need to make sure it is installed. Arpspoof is a part of the dnsiff family, so if you install dnsiff (apt-get install dnsiff), you will get arpspoof as well. However, before everything works, you need to make sure IP forwarding is enabled on the box you plan to use inline. This is because, by default, the system will not forward that packet back on the wire. To accomplish this, I just ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access