Python uses the Scapy library for ARP spoofing

1. Description

ARP Spoofing (ARP spoofing), also known as ARP virus (ARP poisoning) or ARP attack, is an attack technique for Ethernet Address Resolution Protocol (ARP). This type of attack can allow an attacker to acquire packets on the LAN or even tamper with the packets, and make it impossible for a particular computer or all computers on the network to connect properly. The first article to explore ARP spoofing is the ARP and ICMP steering game (ARP and ICMP redirection games) written by Yuri Volobue.
Because the network flow of the LAN is not based on the IP address, it is transmitted according to the MAC address. Therefore, the MAC address on host A is forged into a nonexistent MAC address, which will cause the network is not available, host A can not ping the host C! This is a simple ARP spoofing.

A simple example: here is a simple case to illustrate the core steps of ARP spoofing. Suppose that in a LAN, there are only three hosts a, B, C, and C is the attacker.
　　
1. The attacker listens to the MAC address on the LAN. It can spoof activities by receiving ARP Request with two hosts flooding.
2. The host, A, and a are flooding the ARP Request. The attacker now has two host IP, MAC addresses, to start the attack.
The attacker sends an ARP reply to Host B, sets the sender IP of this packet protocol header to the IP address of a, and the sender Mac is set as the attacker's own MAC address.
3. When Host B receives the ARP reply, it updates its ARP table and changes the host A's entry (ip_a, mac_a) to (Ip_a, Mac_c).
4. When Host B is sending a packet to host A, it encapsulates the link header of the packet according to the ARP table, setting the destination MAC address to Mac_c, not mac_a.
5. When the switch receives a packet of B sent to a, the packet is forwarded to attacker C based on the destination MAC address (mac_c) of the packet.
6. After receiving the packet, the attacker can save it and send it to a for eavesdropping effect. The attacker can also tamper with the data before sending the packet to a, causing damage.

2. Python Code

#!/usr/bin/env python fromScapy.allImport*ImportSYS, getopt def usage():        Print "Usage:sudo/arpspoofer.py [-I interface] <target>  def main(argv):        Try: opts, args = Getopt.getopt (argv,"Hi:t:")exceptGetopt. Getopterror:usage () Sys.exit (2) forOPT, arginchOPTsifOptinch("-H"): Usage () sys.exit ()elifOptinch("-I."): Conf.iface = argifLen (args) <2: Usage () sys.exit (2) Send (ARP (op="Who-has", psrc=args[1], pdst=args[0]), loop=1, inter=0.5)if__name__ = ="__main__": Main (sys.argv[1:])

Python uses the Scapy library for ARP spoofing