Lab 1: ARP Poisoning - Network Penetration Testing - University of the West of Scotland
1. Objective
The main objective of this lab to familiarise students with an ARP Poisoning Attack. To do so, we are
going to setup a web server on the Server 2, then we are going to request Web Pages from the
Client to check that we have connectivity and access to the Server 2. After that, we are going to
perform an ARP Poisoning Attack from the Attacker positioned in the middle of the communications
between Client and Server 2, thus being able to sniff all the communications between them. Finally,
we are going to see how to mitigate this attack.
2. Required scenario
This lab requires the completion of Lab 0. Then, you should use the snapshots created at the end of
Lab 0.
Start the following VMs:
• Router
• Client
• Attacker
• Server 2.
3. Installing a Web Server
Open a terminal in the Server 2. Ubuntu uses apt-get as a tool to download, install, and configure
software in Ubuntu. apt-get maintains the list of the software available in different repositories of
software and manages the number of the repositories that are being controlled by apt-get.
First, we are going to perform an update of the list of software available in the repos managed by
apt-get. “sudo apt-get update”.
Then, we are going to install Apache, the most popular web server being used today. To do so, type:
“sudo apt-get -y install apache2”
Question 1. What is the purpose of “-y” parameter of the previous command?
TIP: If you want to know the complete manual and information about ANY command just type:
“man” and that command name. For example: “man apt-get”
Now, we are going to start apache web server: “sudo service apache2 start”
Also, we are going to make sure that the apache web server is always executed as part of the boot of
this Server 2, “sudo update-rc.d apache2 enable”
Now, in the Client, just open Firefox and insert the following URL: [Link] i.e. the
main web page of the web server available in the Server 2.
Checkpoint A. Please take a screenshot of the web page shown in the screen.
Now, we are going to the Attacker to open a terminal. Then, we are going to execute “sudo
tcpdump”. “sudo” is the command to execute commands as “root” without the need to be
logged in as “root”. “tcpdump” is a program that will show in screen any traffic packets being
received by any network interface of the Attacker. Keep this terminal open.
Lab 1: ARP Poisoning - Network Penetration Testing - University of the West of Scotland
Now go to the Client and refresh the web browser 3 times in order to produce 3 HTTP Requests on
the web server.
TIP: If you want to avoid further locking of the screen so that you are forced to constantly re-login
into the VMs, go to each VM and search “Settings” and click on the “Privacy -> Screen Lock” icon and
disable Automatic Screen Lock
Question 2. Can you see the HTTP request sent from Client to Server 2 in the Attacker tcpdump?
Why?
4. ARP Table
Before starting the ARP Poisoning attack, we are going to see where ubuntu stores the ARP Table on
the Client. By default, Ubuntu 20.04 uses “/proc/net/arp” file to store them. You can show the
information that this file contains using the command “cat /proc/net/arp” or you can use the
command “ip neighbour show” to list the neighbour entries.
Checkpoint B. Please take a screenshot of the ARP Table using one of the previous commands
5. Installing the ARP Poisoning Attacking Tool
On the Attacker, open another terminal and install the Ettercap tool. There are two different
versions of Ettercap, a GUI-based version and a text-only version. Let´s install the graphical interface
since we are going to see the behaviour in tcpdump.
“sudo apt-get -y install ettercap-graphical”
You can see the packets related to the Ettercap software being shown in the other terminal because
they are being downloaded from the software repository.
6. Configuring the ARP Poisoning Attacking
Let´s open Ettercap, just searching “Ettercap” and clicking on the icon. Now, we are going to make
sure Sniffing at startup is checked and the Primary Interface “enp0s3” is selected. Then, we are going
to click the tick at the top right corner to Accept.
After that, we are going to open the Ettercap menu (top right corner), navigate to the Hosts menu
and click on Scan for hosts.
Question 3. What is happening in the Network when you perform the scanning of the hosts?
TIP: You can see the tcpdump available in the other terminal to understand how the scanning of the
hosts is being performed.
Now, let´s see the MAC and IP of the detected hosts. To do so, just click on “Hosts -> Host List”.
Lab 1: ARP Poisoning - Network Penetration Testing - University of the West of Scotland
Checkpoint C. Please take a screenshot of the Ettercap page showing the IP and MAC addresses of
the hosts detected.
Now, we are going to select the targets for the attacks. Notice that we want to be in the middle
between the GW and the Client, i.e. between [Link] and [Link]. Then, let´s select the first IP
address and “Add to Target 1” and then select the second IP address and “Add to Target 2”. To
make sure, we have done it correct, just click on “Targets” -> “Current Targets”. Make sure you have
both in the corresponding lists.
Now, we are going to configure the Man-in-the-Middle Attack, just click on “MITM menu -> ARP
Poisoning”. Then, we click on “Sniff Remote Connections”, this means it will sniff in both directions
of the communication and requires two ARP Poisonings, one for each way of the communication.
Finally, we can start the Sniffing by selecting “OK”
Question 4. What is happing in the Network when you perform the ARP Poisoning? Why?
7. Generating Traffic from the Client
Now on the Attacker, stop the “tcpdump” software by pressing CTRL + C. Then, we are going to run
it again but only showing HTTP traffic. To display this filtering on the screen, just type: “sudo
tcpdump -A tcp port http”
Now on the Client, refresh the web browser 3 times to generate traffic from Client to Server 2 (at
least this is what the Client believes).
Now, let´s go back to the Attacker.
Checkpoint D. Please take screenshots of the tcpdump terminal showing both HTTP Request and
HTTP Reply
Question 5. What is happing in the Network? Why can you see the HTTP traffic in the tcpdump?
Now stop the ARP Poisoning attack by clicking on the Ettercap “MITM menu -> Stop MITM attack(s)”.
Checkpoint E. Please take a screenshot of the ARP Table using the the commands provided on
section 4.
Question 6. What has changed in the ARP Table from checkpoint B to checkpoint E
8. Protecting the Client against ARP Poisoning Attacks
On the Client, update the list of software of the repositories by typing, “sudo apt-get
update”. After that, let´s install Arpwatch “sudo apt-get -y install arpwatch”. Now
we have to create an empty file using the touch command within the /var/lib/arpwatch directory
(sudo touch /var/lib/arpwatch/[Link]). This empty file will be used to store the IP
addresses and MAC addresses of stations connected to the Client network.
First, to see the logs generated by arpwatch, we are going to type: “sudo tail -f
/var/log/syslog”. Then, let´s run the Arpwatch at the Client interface (i.e., enp0s3): “sudo
arpwatch -i enp0s3”. This tool will log any attempt to change the ARP mappings and can send
you an email alerting you about such changes.
Then, go to the Attacker, and perform again the ARP Poisoning attack on “MITM menu -> ARP
poisoning”, check “Sniff Remote Communications” (if it is not already checked) and then “OK”.
Lab 1: ARP Poisoning - Network Penetration Testing - University of the West of Scotland
Now, go to the Client and view the logs.
Checkpoint F. Please take a screenshot of the syslogs showing the ARPWatch alert about the new
station.
Question 7. Please, explain the logs shown in the syslogs about the ARPWatcher?
Finally, stop the ARP Poisoning, Ettercap and tcpdump services etc. on the Attacker.
TIP: You can stop arpwatch service by typing sudo /etc/init.d/arpwatch stop
Remember to upload both Checkpoints and answers to the questions to the turn-it-in activity
enabled in MyUWS for that purpose.
