Python uses the scapy library for ARP Spoofing

Python uses the scapy library for ARP Spoofing
1. Description

ARP spoofing, also known as ARP attack or ARP attack, is an attack technique against the Ethernet Address Resolution Protocol (ARP. This attack can allow attackers to obtain packets or even tamper with data packets on the LAN, and prevent a specific computer or all computers from connecting to the network. The first article to explore ARP spoofing is ARP and ICMP redirection games Written by Yuri Volobue ). Because the network flow of the LAN is not based on the IP address, but based on the MAC address. Therefore, the MAC address on host A is forged into A non-existent MAC address, which will cause network failure. host a cannot Ping host C! This is a simple ARP spoofing.

A simple example: Here is a simple case to illustrate the core steps of ARP spoofing. Assume that in a lan, there are only three hosts A, B, C, and C are attackers.

1. The attacker listens to the MAC address on the LAN. It can perform spoofing activities only when it receives a flood ARP Request from two hosts.

2. host a and host B flood ARP requests. The attacker now has two host IP addresses and MAC addresses and starts attacks.

The attacker sends an ARP Reply to host B, sets the sender IP address in the protocol header to the IP address of A, and the sender mac address to the MAC address of the attacker.

3. After host B receives ARP Reply, it updates its ARP table and changes the entry (IP_A, MAC_A) of host A to (IP_A, MAC_C ).

4. When host B wants to send data packets to host A, it encapsulates the Link header of the data packet based on the ARP table, and sets the destination MAC address as MAC_C instead of MAC_A.

5. When the switch receives the packet sent by B to A, it forwards the packet to the attacker C Based on the target MAC address (MAC_C) of the packet.

6. After receiving the packet, the attacker can save it and send it to A for eavesdropping. Attackers can also tamper with the data before sending data packets to A, causing damage.

2. python code

#!/usr/bin/env pythonfrom scapy.all import * import sys, getopt defusage():print"Usage: sudo ./arpSpoofer.py [-i interface] "defmain(argv):try: opts, args = getopt.getopt(argv, "hi:t:") except getopt.GetoptError: usage() sys.exit(2) for opt, arg in opts:if opt in ("-h"): usage() sys.exit() elif opt in ("-i"): conf.iface = argif len(args) < 2: usage() sys.exit(2) send(ARP(op="who-has", psrc=args[1], pdst=args[0]), loop=1, inter=0.5) if __name__ == "__main__": main(sys.argv[1:])