{"id":2087,"date":"2019-02-23T21:52:00","date_gmt":"2019-02-23T20:52:00","guid":{"rendered":"http:\/\/labalec.fr\/erwan\/?p=2087"},"modified":"2019-02-24T14:05:55","modified_gmt":"2019-02-24T13:05:55","slug":"arpspoof-freepascal","status":"publish","type":"post","link":"https:\/\/labalec.fr\/erwan\/?p=2087","title":{"rendered":"arpspoof-freepascal"},"content":{"rendered":"

Lets play with Winpcap<\/a>.<\/p>\n

Quoting the winpcap web site : \u00ab\u00a0WinPcap consists of a driver that extends the operating system to provide low-level network access and a library that is used to easily access low-level network layers\u00a0\u00bb.<\/em><\/p>\n

Lets use it to perform a quick and easy man-in-the-middle-attack<\/a> with arp spoofing<\/a>.<\/p>\n

Quoting wikipedia : \u00ab\u00a0a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other\u00a0\u00bb.<\/em><\/p>\n

Source code and binaries are available here<\/a>.<\/p>\n

Usage is:
\narpspoof 1.0 by erwan2212@gmail.com
\narpspoof list-interfaces
\narpspoof interface-index ip1 ip2<\/strong><\/p>\n

Example:
\narpspoof.exe 0 192.168.1.125 192.168.1.250
\narpspoof 1.0 by erwan2212@gmail.com
\narpspoof list-interfaces
\narpspoof interface-index ip1 ip2
\nip1:192.168.1.125 mac1:001DE0-567737
\nip2:192.168.1.250 mac2:C05627-B7FD32
\nspoofed mac:94DE80-C2A41E
\nsending packets…press a key to stop…<\/strong><\/p>\n

192.168.1.125 is victim (a computer on my network).
\n192.168.1.250 is my network gateway\/router on my network.
\n94DE80-C2A41E is my mac address (i.e the attacker mac address).<\/p>\n

192.168.1.125 will believe that mac address of the router (192.168.1.250) is mine i.e 94DE80-C2A41E.
\n192.168.1.250 will believe that mac address of the victim (192.168.1.125) is mine i.e 94DE80-C2A41E.
\nIn effect all traffic between these 2 hosts will go thru my computer.<\/p>\n

One important thing not to forget : enable forwarding on your computer or else all traffic between these 2 hosts will be dropped.
\nHow? easy :
\n-check your interfaces : netsh interface ipv4 show interfaces<\/strong>
\n-enable forwarding on the desired interface : netsh interface ipv4 set interface x forwarding=\u00a0\u00bbenabled\u00a0\u00bb<\/strong><\/p>\n

Now you can perform an attack with intercept-dns<\/a> from a previous article (dont forget to do a set layer=forward on the command line then).
\nOr simply sniff\/capture the traffic with netdump<\/a>.<\/p>\n

Note that you could also use a GUI like Iptools <\/a>to perform arpspoof.
\nSee example screenshot here <\/a>(C=client\/victim, R=router).<\/p>\n","protected":false},"excerpt":{"rendered":"

Lets play with Winpcap. Quoting the winpcap web site : \u00ab\u00a0WinPcap consists of a driver that extends the operating system to provide low-level network access and a library that is used to easily access low-level network layers\u00a0\u00bb. Lets use it to perform a quick and easy man-in-the-middle-attack with arp spoofing. Quoting wikipedia : \u00ab\u00a0a man-in-the-middle […]<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[108,107,106],"class_list":["post-2087","post","type-post","status-publish","format-standard","hentry","category-network","tag-arpspoof","tag-mitm","tag-winpcap","category-5-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"_links":{"self":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/2087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2087"}],"version-history":[{"count":8,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/2087\/revisions"}],"predecessor-version":[{"id":2099,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/2087\/revisions\/2099"}],"wp:attachment":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}