ARP spoofing test with CAIN

The following are some tests on common cain tools used by hackers. Please take precautions

Enable sniffing first

Select the NIC to sniff

Scan the MAC addresses of all hosts on the CIDR Block

Go to the APR page, add the host address for ARP spoofing in the box on the left, and select the gateway of the host in the box on the right.

Enable APR

This is, the APR will send ARP corresponding to the host and Its gateway, telling them the MAC address (e9: 9a: 1a) of the APR host, that is, the MAC address of the response.

View the ARP table of the Target Host:

The MAC address of the Gateway has changed to the MAC address of the APR host, instead of the MAC address (71: 7b: a0) of the router.

In this way, the APR host intercepts the packets sent from the gateway or gateway to the host so that they can first pass through the APR host and then forward the packets to the peer end so that packets can be captured on the APR host, view the communication content, password, and other information between them