Guide to ARP Spoofing

L33tdawg: This article first appeared over at our affiliates' site Underground Mac. The original article can be found here.

By: Barfbag

ARP spoofing is an effective way to intercept, sniff, hijack and DoS connections. It is a more effective way of hijacking sessions, because it allows attackers to see incoming and outgoing communications, as if they were a proxy, as opposed to "blind" TCP/IP spoofing.

Background on ARP

ARP stands for Address Resolution Protocol. Basicaly it translates IP addresses into ethernet or MAC addresses. ARP is completely separate from TCP/IP, since it uses only the ethernet frame in its packets. ARP is very similar to DNS, except instead of converting host names to IP addresses, ARP converts IPs to MAC addresses.

MAC addresses
A MAC address, or Media Access Control, is the address hard coded into the ethernet card. Changing it is possible but irrelevant to this article. MAC addresses consist of six hex numbers separated by colons or dashes ie. 00:3E:41:D2:53:21 or 00-3E-41-D2-53-21. Routers use these addresses along with IPs to route packets for example:

Machine A wants to open a connection on server B

1) A sends ARP to subnet asking "who has B's IP address? tell Machine A"
2) All Machines on the subnet recieve the query, if their their IP matches that of the query then they send back a response in this case:
3)Server B sends an ARP response of "My IP is at ethernet address 00:3E:41:D2:53:21" or whatever.

An insteresting thing about ARP, is that to improve efficientcy, it caches entries. This is so that every packet doesn't need to have a corresponding ARP query and response. Instead, the machine remembers what IP corresponds to what MAC. This cache is called an ARP table, and is flushed about every minuet or so depending on the operating system.

ARP Spoofing

Alright, enough of the boring stuff. On to the fun part: ARP spoofing. Here is the vulnerablility in the ARP protocol: to improve efficiency, most systems update their tables every time they get a response, even if they didn't ask for it. This means that an attacker can send a message out to computer B, saying "Computer C is at my MAC". Packets sent from B, to C's IP will instead be routed to The attackers computer. Below is A diagram:

A simple ARP Hijack
Note: for clarity, MAC addresses will be represented by Shapes.

A:Attacker:Square:192.168.0.2
B:Box:Triangle:192.168.0.3
C:Server:Circle:192.168.0.4

1)A--->B "192.168.0.4(Server) is at MAC address Square"
2)A--->C "192.168.0.3(Box) is at MAC address Square"

Now any communication from Box to server or Server to Box, is routed to the attacker, who can now decide what to do.

ARP Spoofing as DoS

One sneeky way of launching a Denial of Service attack is similar to DNS poisoning. Basicaly, the attacker tells the box he is DoSing that either his, or some other computer's MAC attaches to that of the routers. Basicaly what happens here is all of the DoSed box's packets go to some other computer instead of the router, making it impossible to access addresses outside the subnet.

...As Sniffing

Sniffing or passive hijacking is when the attacker lets the to machines talk to each other but monitors or "sniffs" the communications for information like logins or passwords. This can be extreamly devistating because the attacker can then gain authenticated access into the system.

...As Hijacking

Ah yes, if the attacker happend to decide to, he may cut off the user form the server and inject his own commands. Lets look at this example: Andrew, the attacker has set up a ARP hijack between server Sam and client Clay. Andrew watches as Clay telnets into sam and logs in. As soon as this happens Andrew stops forwarding Clay's packets to Sam. He then injects his own packets to Sam, pretending to be Clay that instruct Sam to create a new user account (using Clay's privleges). Andrew then starts forwarding packets from Clay back to Sam and Clay dismisses the lag to his bad connection. That is basicaly how ARP hijacking works, it can get a bit more complicated, but the purpose of this guide was to give a general understanding. Hope it helped.

Questions and Comments >> barfbag@theblankpages.com

1.) Reducing "Human Factor" Mistakes - Dancho Danchev
2.) Virtual File System - /proc - Danny “Dr.T”
3.) Hiding Files - [in]visible
4.) Better Living Through Mod Security - L33tdawg
5.) Guide to ARP Spoofing - Barfbag
6.) SMOKE="gentoo" - mel
7.) Nessus - Doing more with Less - christian