Catch a MiTM ARP Poison Attack with Wireshark // Ethical Hacking

so in this video i'm going to show you how you can use wireshark to spot an arp poison attack on the network so stick around okay welcome back to the channel everybody so if you already saw the previous video in this little mini series we're doing on man in the middle attacks uh i showed you how to do an arp poison attack with ettercap we went and captured that with wireshark and then i showed you how ettercap actually sends that arp unsolicited arp reply in both directions to those target devices but what we're going to do in this video is i'm going to show you how if you happen to see that kind of behavior on the network how can you capture it with wireshark and better yet how could you set a filter to be able to spot it quickly so let's go ahead and get into it okay so now i'm on the windows 10 box and we're gonna go ahead and capture from that vantage point so how would that look how can we catch it in wireshark all right so i do have some traffic being captured by wireshark i actually have an arp filter right here while i'm actively capturing which is kind of an interesting thing to do if there's something specific you're looking for you can apply that filter and then you can run wireshark and just watch for it to come in okay so i see that i've got a couple arps already and thankfully one's from my gateway so i can see what the true gateway mac address is this 3500 but now i'm going to go over to the man in the middle all right so some hacker comes on my network some kind of way and he goes ahead and starts them in the middle so let's go ahead and start that i'm going to come up to my arp poisoning and i'm going to go ahead and say okay so here on the window side we can see that the gateway quote unquote which is really the man in the middle is advertising that 5372 address all right i'm going to go ahead and stop my capture and let's go ahead and take a closer look at what we captured all right so first thing i can notice that i have my legitimate arp here and this came from the gateway tell 2.15 which is me and here i can see 3500 but then i see these unsolicited arp let's click one of them replies come in i'm going to open up the arp part and i'm going to come down there to the details and unsolicited arp reply now thankfully because i had already captured a legitimate arp reply from the gateway up above wireshark can tell me that wait a second there's been a change here there's going to be a dupe ip address detected for 2.1 i'm seeing two mac addresses for this one ip so since that's the case i can go ahead and use this as a filter i can just expand this out i can come down to expert info dupe ip address configured or if we look down at the bottom arp dot duplicate dash address dash detected right click that guy i'm going to prepare a filter and i'm going to come up and just say selected okay great now that will show me all the bad arps but that's only going to work if i already have captured one of the arps from the gateway one of the legitimate ones well what if i hadn't captured that one so my goal would be to build a filter that will flag any arps coming from the gateway's ip address that are not the gateway's mac address that's going to be our goal all right so let's go ahead and do that first thing i'm going to do just because this is just my obsessive compulsive rising up a little bit i'm going to come down to profile and you see i'm on default uh one of the first things i'm going to do hopefully you guys have done this at this point but if you haven't go ahead and join me what i did is just right click over profile and i'm going to go to new and i'm just going to create a new profile i'm just going to call it security so now when we create specific filters like the one we're about to build we can save it under that profile and we can go ahead and grab it anytime we want so i'm going to say okay all right so now we're under our security profile all right so again our goal is to build a filter that will catch all arp replies that are acting like our gateway but are under a different mac address okay so think about that statement so first thing i'm going to do i'm just going to remove the arp duplicate address detected and i'm going to stay right there on packet 160. make sure i click that going to remove this filter let's back it up okay so what's my goal here first of all i'm going to come down to my arp details i want to catch any arp coming from 10 0 2.1 that is my gateways ip okay so i'm going to come up to prepare as filter so i'm going to say selected nice thing about prepare as filter is it doesn't yet apply it it lets me see it make adjustments make any additions and then after i'm done building the filter then i can apply the whole thing all right so this is going to be any arp source from 1002.1 and it's also going to be a reply all right so let's just right click and we're going to come out to prepare as filter and we're going to say and selected so i want to catch all packets that are advertised from 2.1 that are our replies but here's the catch i only want to capture the ones that are not from the legitimate gateway so i'm going to do is i'm going to go back to that original arp from the gateway and i'm going to add his mac address as the the address that i don't want to focus on so i'm going to go up and find the arp from the gateway let's do it let's just go up a few packets here and i can see the true response from the gateway here we go so this is 2.1 and it's giving me that 3500 so now what i'm going to do is i'm going to right click under sender's mac address so this is where the sender is alleging to be from he's saying hey here's my mac for this ip i'm going to right click that only this time i'm going to say prepare as filter and i'm going to say and not selected okay let me just add that up and i'm going to show you how this filter works up top okay i want all arps that are coming from 2.1 or claiming to be 2.1 i want all arps that are just the replies i don't care about the requests and i want any of them so those two things have to be met and the arp source hardware mac address cannot be 3500 so show me anyone that's basically spoofing 2.1 don't show me the real ones show me anyone that's trying to do an art poison for my gateway all right so let me go ahead and apply this and there i see those spoofed mac addresses so this is a nice filter to have actually i'm going to copy it and i'm going to put it down in the description below so you can copy it in your system and you can adjust it to meet whatever it is you need it to do as far as the mac address of your gateway and the ip of your gateway just put those two values your true gateway ip and your true gateway mac address there in that part of the filter and now you'll have the same filter for your environment but before we do anything else let's go ahead and save this i'm going to come over to the plus button and i'm going to say arp poison attack okay going to say all right so now that's a save filter if i ever leave wireshark come back or if i'm looking at something on my network i can just come up here and i can just click this so this time what i'm going to do is i'm just going to go ahead and close out this capture and let's go ahead and start just continue without saving let's go ahead and start a new capture ethernet let's test our filter to see if it worked okay i'm going to come up to our poison attack now imagine that i'm sitting in my nock or i'm sitting somewhere where i'm monitoring the network i have this running i have it up in a corner somewhere this is where i can see with this filter anyone that is acting as if they were the gateway spoofing me so this is a nice filter to have especially if you want to capture someone doing an art poison now we may have another security monitoring tool that would catch this as well but this is how we would capture an art poison attack with wireshark i hope this video was useful to you and that you like this kind of content let me know in the comments down below of course like subscribe thanks for stopping by i'll see you guys again on another video [Music]

Channel: Chris Greer

Views: 1,084

Keywords: MiTM attack, MiTM kali linux, ettercap arp poisoning, arp poisoning attack, Wireshark arp analysis, Wireshark tutorial, wireshark tutorial kali linux, man in the middle attack, man in the middle attack kali linux, 2022 wireshark tutorial, wireshark capture, ethical hacking, ettercap, wireshark, hacking, wireshark filters, arp spoofing

Id: Evb1x3FJjEo

Length: 7min 57sec (477 seconds)

Published: Tue Dec 14 2021