TechKnowSurge

VideoSecurityFree

DEMO: ARP Cache Poisoning

ARP cache poisoning is a network attack technique in which an adversary corrupts a device's ARP table to redirect traffic through a machine they control. It is commonly used to execute adversary-in-the-middle attacks on local area networks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The Address Resolution Protocol exists to resolve IP addresses to MAC addresses on local area networks, allowing devices to build and maintain an ARP cache that maps Layer 3 addresses to their corresponding Layer 2 addresses. When a device needs to communicate with another host on the same network, it first checks this local cache before broadcasting an ARP request to the network. Once a response is received, the mapping is stored in the cache for future use, reducing unnecessary broadcast traffic and speeding up communication. ARP cache poisoning exploits a fundamental weakness in this process: ARP has no authentication mechanism and devices will accept and store address mappings from any source, including unsolicited ones. An attacker can send gratuitous ARP replies, which are ARP responses that were never requested, to overwrite legitimate cache entries on victim devices. By associating their own MAC address with the IP address of a trusted network resource such as the default gateway or a DNS server, the attacker causes victim devices to forward traffic to the attacker's machine instead of the intended destination. This technique is most commonly used to establish an adversary-in-the-middle position, where the attacker sits between two communicating parties and can intercept, inspect, or manipulate all traffic passing between them. For example, poisoning both a victim's ARP cache and the gateway's ARP cache simultaneously causes all traffic flowing in both directions to pass through the attacker's system, which can then use a packet capture tool to monitor the full communication stream. If the attacker impersonates a DNS server instead of a gateway, they gain the ability to redirect the victim to arbitrary destinations, including fraudulent or malicious websites. Successful ARP cache poisoning requires the attacker to be on the same local network segment as the target, making it a particularly relevant threat in shared network environments. Defenses against this attack include dynamic ARP inspection on managed switches, static ARP entries for critical devices, and network monitoring tools configured to detect sudden changes in IP-to-MAC address mappings.

What you'll learn

Explain how ARP cache poisoning works, including the role of gratuitous ARP in corrupting IP-to-MAC address mappings
Describe how ARP cache poisoning enables adversary-in-the-middle attacks by redirecting network traffic through a malicious host

What's covered

ARP Cache Poisoning

ARP Fundamentals
- Resolves MAC from IP
- ARP Broadcast Process
  - Client broadcasts IP request
  - Server unicasts MAC reply
- ARP Cache Table
  - Stored on local machine
  - Speeds up communication
Attack Methods
- Intercept ARP Reply
- Gratuitous Unsolicited ARP
  - No request needed
  - Forces cache update
Attack Outcomes
- Adversary in the Middle
  - Intercept outbound traffic
  - Impersonate default gateway
- DNS Impersonation
  - Redirect to malicious sites
Demonstration
- Three Machines Involved
  - Victim client machine
  - Layer 3 switch gateway
  - Kali Linux adversary
- Ettercap Tool Used
  - Scan and select targets
  - Launch ARP poisoning
- Wireshark Traffic Capture

Key terms

Address Resolution Protocol: A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control: A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address: A numerical label assigned to each device connected to a network that uses the Internet Protocol.
ARP Cache: A table stored on a local device that maps known IP addresses to their corresponding MAC addresses to speed up network communication.
Gratuitous ARP: An unsolicited ARP reply sent by a device to update the ARP caches of other devices on the network without a prior request.
ARP Cache Poisoning: A sub-technique of adversary-in-the-middle attacks where an attacker sends forged ARP messages to link their MAC address with a legitimate IP address, redirecting traffic through the attacker.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Default Gateway: The router that a device uses to send traffic to destinations outside its local network.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Arp Arp Cache Poisoning Adversary In The Middle Gratuitous Arp Network Security Networking

Transcript

ARP cache poisoning can actually go by many different names: ARP cache poisoning, ARP spoofing, ARP poison routing, and there's several other names as well. Simply put, ARP cache poisoning is the poisoning or changing of an ARP table or ARP cache. What a machine has is an ARP cache, and an attacking machine will poison those records in there.

What ARP does

In order to fully understand this, we have to understand what address resolution protocol is, or ARP. Hopefully you already have a concept, but I'm going to give a brief overview of what ARP is and what it does.

ARP is just address resolution protocol. So what addresses is it resolving? Well, it's resolving the MAC address from an IP address.

So here we have a local area network. Now, it does operate a little differently than this if you're talking to a remote network, but let's say we're talking all locally. What happens is that this machine wants to talk to a server. So what it needs to do is first of all create the packet, and within the packet it's going to have a destination IP address of that server's IP address. But when you're communicating across Ethernet, a local area network, a layer 2 network, you need an address of where it's going — not just an IP address, but a layer 2 address, the MAC address. And so what it's going to do is actually send the frame to this destination MAC address, which is AA BBCC112233.

But it might not necessarily know that. What it does know is the IP address that it's trying to get to. So once it knows this IP address, it needs to resolve what is the MAC address that's associated with that IP address. So that's where the address resolution protocol comes into play.

First of all, what this client does is shout out to everyone. It's a broadcast, and says, hey, who belongs to 192.168.1.5, this IP address right here? So it gets broadcasted out all connections, and then this server replies and says, oh, that's me. That's just unicasting, it goes back to this machine and says, yeah, that's me, my IP address is 192.168.1.5 and my MAC address is a a bbC11223. And so now this machine knows the address, the layer 2 address that's associated with that layer 3 address.

The ARP cache

One thing that helps speed up this process is an ARP cache. The ARP cache is a table that's kept on the client machine, on the local machine, so that way, before it just sends out and starts sending all these messages every time it needs to communicate — hey, who belongs to this address? — and once it gets that information back, what it will do is it'll put it on its ARP cache. So it actually checks the ARP cache first and says, hey, do you have this address? Do you have the MAC address associated with this IP address? And it takes a look at that ARP cache. If so, then it never needs to make that request to the rest of the network, and it just uses that information to send it on. So that's how the ARP cache works.

How the poisoning works

So ARP cache poisoning is when an adversary puts a wrong record inside of this table right here. So as soon as it has an IP address — maybe it's 192.168.1.5 — but it associates it with the MAC address of this machine. Now maybe this machine is 444 and so on and so forth, you get the point. But that's what gets put into this ARP table, that's being associated with 192.168.1.5. And by doing this, every time this machine wants to send traffic to this machine over here with this IP address, instead it ends up sending it to the adversary.

So what does this look like? One way that this could happen is just every time this machine asks for the IP address here, instead the adversary replies and says, oh yeah, that's me, with an incorrect IP address. And so now what's happened is it's poisoned the ARP cache table, because it's got the wrong IP address to MAC address mapping in it.

But there's even a better way to do this. It's known as a gratuitous ARP or unsolicited ARP. Let's say that this machine already has asked who belongs to 192.168.1.5 and got the response of this a bc bc 1112233, and that's already been put into the table. Well, all this attacking machine has to do is send this unsolicited ARP. That means that the client machine over here has never sent or never requested for an update, but this machine is giving an update. And we want things to be dynamic, so this is good, this is how it's supposed to operate. But the problem is that it's this adversary giving an update, and it says, well, this is the MAC address associated with this IP address, it's now 44444. Now what happens is this machine updates its table with that information, and now the ARP cache is poisoned.

What the adversary gains

So now we can actually pose as something else on the network, like the router, maybe it's a DNS server, maybe it's other servers or services that are on the network, whatever the case may be. We can pose as that device and be able to do some sort of machine in the middle or some other type of attack.

If it's the default gateway, now any traffic that was originally destined to the outside world now is going to go through the adversary first before it goes to the outside world. That could be very devastating, because now this adversary in the middle is seeing all the traffic that this computer is intending to go to some other device.

Let's say in this case this is the DNS server, and now what this adversary is doing is mimicking this DNS server. In this case, rather than resolving an IP address to a domain through the proper DNS server, instead now that traffic is going to this adversary. This adversary now has the ability to really send that computer anywhere that it wants it to go. So it could be itself, so that way it could host out some sort of, or mimic some sort of, website. Or maybe it's some other website that's out on the web that it's sending to that's a malicious site. So now this computer is tricked into going to sites and to different services and different places that it didn't intend to go to, some sort of malicious activity.

The demonstration setup

Now I'm going to show how to do this ARP cache poisoning. But I want to stress that we need to practice ethical hacking only. That means only practice this on your own machines and networks, or a machine and network that you've gotten permission to use to practice on.

So in this demonstration, we're going to do an adversary in the middle attack using address resolution protocol cache poisoning. And the cache tables that we're going to poison are these two cache tables right here, associated with two different machines.

Essentially, we're going to have three machines involved in this. First of all is going to be the victim machine and their ARP cache. Then it's going to be the default gateway for that victim machine and their ARP cache — in this case, it's actually a layer 3 switch, and we'll jump onto that layer 3 switch and see what that looks like. And then we have the adversary.

And so notice their IP addresses. We've got 193 for the victim. We got one, which is pretty standard for the default gateway. And our adversary is 31. The other thing I'll draw attention to is the MAC addresses. Notice that these MAC addresses for both the client machine and the adversary are very similar, and that's because they're both on the same virtual box. So we're going to take a look at the last part of this: B8 for the victim machine, 81 for the adversary machine, and C2 for this default gateway, this switch, the Sele 3 switch that we're going to get onto.

Verifying the addresses

What we're going to do is verify all that information. So first of all, I'm on the adversary box, the Kali Linux box, and I'm going to type in ip space a. We can see that this ends in 81, and the IP address is 31. That makes sense, we're good to go there.

Next up, let's take a look at the victim machine. I'm going to type in ipconfig slash a, or slash all, and hit enter. And here we see that 193 is the IP address up here, and the physical address is B8, so that's the MAC address right there. And the gateway server is 10.110.1. That makes sense.

And then we're going to do an arp -a, and this shows the ARP table. So this is all that ARP cache that we're taking a look at. And so 10.110.1 ends in C2, so that is the layer 3 switch.

So now we're on that layer 3 switch. I'm going to do a show arp and hit enter, and this is showing the ARP cache on this switch. And we see that the 10.110.1, which is itself, ends in C2. So that's verified. And the 193 ends in B8. And we also see that the 31 ends in 81. So all of that is just as I mentioned before.

Running the attack

So on our Kali Linux box, we're going to open Ettercap. So here's Ettercap. We're going to open it up, we're going to get this started just on eth0, so I'm going to start that.

The first thing I'm going to do is just do a scan. So this is scan for host, it's the little magnifying glass. So I'm going to click on that magnifying glass to scan for host, and here we see that it found 11 hosts on this network. And if I want to see the list, I can click on this to see the host list, so these are all the hosts.

What we're doing is, there's really two victims here. There's going to be the 193 — so this is the victim, this is where we're trying to see the traffic going to and coming from this victim right here. So we're going to add that as target one, and it logs it as target one. And then target two is going to be any traffic that's going to the outside world, which is any traffic going to the default gateway, so we're going to add as target two. So these are the two targets.

What we can do now is launch that ARP poisoning and get that started. I could select only poison one way, but I want to see all the traffic that's coming back and forth. So we're going to click on okay, and it launches that.

So I'm back on the victim machine. What we'll do is I'm going to hit the up arrow and hit arp -a so we can see what the difference is. So before, this 10.110.1 was C2 on the network, which is our layer 3 switch, and now it's 81 instead. So what it's done is it's switched, and now any traffic that would have gone to the default gateway is now going to the Kali Linux box.

Here is that I'm sshed into that layer 3 switch. So I'm going to do a show arp on it, and now the 193 is going to 81. That's the adversary box. So instead of sending traffic directly to the victim, instead it's going to the adversary box now.

So at this point in time, if I wanted to see what traffic is actually going across this, then all I would need to do is pull up Wireshark, and I can click on Wireshark and see any of the traffic that's going across between these. We'll do eth0, and then that's going to show the traffic that's going in between it. And what I could do is I could go back to my victim box and open up a web page just to see what kind of traffic it generates. So I got some downloads going and some stuff going, and as we can see, it's generating a ton of traffic.

So this is what an adversary in the middle looks like, where we've done ARP cache poisoning on both sides. So both think that the adversary is the one that they want to talk to, so all the information is flowing back and forth now through the adversary.

The attack card

Here's the attack card on ARP cache poisoning. What's happening is that we are poisoning the cache. The ARP cache is that table that these devices have, so that way they know the layer 2 address that's associated with any layer 3 address — that's the MAC address associated with the IP address. And so what's going to happen is the adversary is going to poison that cache, so traffic could be sent to the adversary rather than the destination machine, the intended machine. So a lot of times it's used to carry out an adversary in the middle attack. It can carry out this type of attack by sending a gratuitous ARP, something that is going to be an extra ARP that's not requested, but it sends it and then alters the ARP cache table.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →