Cain Tool ARP Spoofing attack

Os:win7
Tool: Cain
Http://pan.baidu.com/s/1xq9lW Password: 409z
Network: Native and hacked computer wired router.

Cain is a well-known LAN sniffing tool with rich features.
For example, you can decrypt the wifi password stored locally.


The following attempts to perform ARP spoofing.
Configure the network card in the settings and turn on sniffing and ARP in the toolbar.
Select the upper Sniffer tab and click the plus sign to scan the hosts in the LAN.


Scan three results, the first one is my Tp-link router, the second is the attack computer. The third Apple-named result doesn't know what's going on when there is no Apple device connection, maybe the routing table saved in the router is displayed? The test found that regardless of whether the Apple device is connected or not, the scan results are three of these. The reason remains to be explained by my knowledge of the network.
Select the ARP tab below and click the toolbar plus sign to add the device you want to spoof for ARP. After adding is complete


Poisoning, poison ....

Click on the Passwords tab below to view the captured password.

I landed on the hacked computer with a Chrome browser, and Chrome gave me a warning about douban, and I clicked on.

In Cain, my Douban username and password are displayed in clear text!


This illustrates two issues:
1.ARP spoofing can be found, and chrome gives a warning message.
2. Quite a few websites use plaintext to transfer passwords. A while ago, I saw in the discussion that many large websites in the country, the issue of the plaintext transmission of passwords, is indeed very insecure.

In the attack on the computer multiple times (with the wrong password) login, chrome no longer give a warning, Cain also intercepted these passwords.

But landing QQ space found that QQ is not the plaintext transmission password, Cain intercepted information


It can be seen that the security of QQ is relatively high. But the URL is indeed completely intercepted. A few years ago there are ways to view each other's space and photo albums, what is needed is the other side of the full URL after landing, do not know that this method is not feasible today.

Then I tried the DNS spoofing, but there is a problem, using the spoofed computer to log on to the spoofed Web site will not open the page. Open with IE will prompt an unknown error. Pending research.

Cain Tool ARP Spoofing attack