Spoofing the ARP Table of Remote Computers on a LAN

0. Object of Document

This document explains how to use the WinArpSpoofer program, which spoofs the ARP table of remote computers on a LAN and describes the CBuildPacket class that builds and throws a packet into the network.

1. Introduction

1.1 What is ARP spoofing

ARP spoofing, also called ARP Cache poisoning, is one of hacking methods used to spoof the contents of an ARP table on a remote computer on the LAN. Two addresses are needed for one computer to connect to other computer on an IP/Ether network. One address is the MAC address; the other is the IP address. A MAC address is used on a local area network before packets go out of the gateway; an IP address is used to surf the Internet through a gateway. There is a protocol that asks "who has this MAC address" and answers the question; that is called ARP (Address Resolution Protocol). What the ARP asks the target address for sending is called the ARP Request or ARP who has, and the ARP that responds to the request is called the ARP Request or ARP who has. Although wrong information is inserted into ARP, the computer believes that the information of the ARP is valid and saves the information in its own ARP table for a while. This is ARP spoofing.

Figure 1: ARP Spoofing

1.2 WinArpSpoofer Program

WinArpSpoofer is a program to manipulate the ARP table of another computer on a LAN. Especially, by changing the ARP table of a router, this program can in effect pull all packets on the local area network. After pulling and collecting all packets, this has a function that can forward them to the router (gateway). If you run this program and any sniffer program, you can even get and see all user IDs/passwords on the switch network. This program needs the WinPcap driver and has been tested on WinNT/2000/XP/2003 etc.

1.3 CBuildPacket Class

CBuildPacket is a class that builds a WinArpSpoofer program. Its general purpose is to easily build a cooked packet throwing into the network. It is hard to understand and use existing libnet libraries and so forth in MS Visual.NET, so I have newly designed this class.

The current version of the CBuildPacket class provides some methods for building and sending an ARP to the network. The future version of this class will provide many various types of network packets for building TCP, IP, icmp, and the like.

WinArpSpoofer has been built based on the current CBuildPacket class. It could pull and collect all packets without the users' recognition. The current version, 0.1, has been built for spoofing ARP tables and actually forwarding packets, so we didn't consider a neat and convenient user interface. For the future, when upgrading, that point will be improved.

1.4 Features of WinArpSpoofer

Functions and features of WinArpSpoofer program are as follows:

  • It can pull and collect all the packets on the LAN.
  • It can scan and show the active hosts on the LAN within a very short time (~1–2 seconds).
  • While spoofing arp tables, it can act as another gateway (or ip-forwarder) without other users' recognition on LAN.
  • It can collect and forward packets by selecting inbound, outbound, and both to be sent to the Internet.
  • An ARP table is recovered automatically in a little time (about 30 seconds). But, this program can keep spoofing continuously with a periodic time.
  • Although one or more network interface cards are installed on a computer, this program can scan and spoof selecting one of the NICs.

Because most functions are processed through threads, this program is faster than you think. Spoofing itself doesn't allocate much CPU time. But, if there are many active hosts on the LAN, the problem related to CPU time will be different.

2. Environment

2.1 WinArpSpoofer

System environments using WinArpSpoofer are as follows:

  • Local OS: All Windows platforms
  • Remote OS: All computers and network devices having an ARP table
  • Requisite driver: Current version must install WinPcap Driver (as recent as possible)
  • Main Memory: 64 MB or more
  • HDD: Free space should be 10 MB or more

We actually have tested this program on Windows NT/2000/XP/2003. I am not sure that Win 9x/ME can run this program. In addition, this program is later going to be used without the WinPcap driver.

2.2 CBuildPacket

To use the CBuildPacket class, the WinPcap driver is needed; the IPHlpApi library in the Platform SDK is needed also.

3. The Methods for spoofing ARP Table

3.1 Notations.

  • A,B,a,b: Active computer entities on network. When programming, this means an Ethernet MAC address.
  • Target: A target computer against spoofing attack.
  • Attacker: An attacker's computer.
  • aIP,bIP: IP address of A,B.
  • aMAC,bMAC: MAC address of A,B.
  • TargetMAC: MAC address of the target computer.
  • TargetIP: IP address of the target computer.
  • AttackerMAC: MAC address of the attacker.
  • AttackerIP: IP address of the attacker.
  • ARPrequest: A -> B with (aIP,aMAC,bIP,bMAC): In a ARP packet meaning "ARP who has," to put (IP address of ARP Source A, MAC address of ARP Source A, IP address of ARP Target b, MAC address of ARP Target b) and to transfer A to B.
  • ARPreply: A -> B with (aIP,aMAC,bIP,bMAC): A responsive packet of ARPrequest.

3.2 How to spoof the ARP table

ARPrequest: Attacker -> Target with (aIP, AttackerMAC, TargetIP,TargetMAC)

or

ARPreply: Attacker -> Target with (aIP, AttackerMAC, TargetIP,TargetMAC)

If you do as shown above, an ARPrequest with the wrong information is sent to a target computer and the the target computer knows that the MAC address of A is the Attacker's MAC addres in the ARP table. Therefore, all the packets that the target sends to A are sent to the Attacker.

ARPreply packets are used to keep ARP spoofing. Likewise, the target knows that the MAC address of A is the MAC address of the Attacker in an ARP table. Therefore, all the packets that Target sends to A are sent to the Attacker.

3.3 How to recognize that there is the same IP address on the network

ARPreply: Attacker -> Target with (TargetIP, aMAC, TargetIP,TargetMAC)

or

ARPrequest: Attacker -> Target with (TargetIP, aMAC, TargetIP,TargetMAC)

If you do as shown above, a target computer recognizes that there is the same IP address on the local area network, so the target computer will show "collision of network ip address."

3.4 how to recover spoofing (Unspoofing)

ARPreply : Attacker -> Target with (aIP, aMAC, TargetIP,TargetMAC)

If a correct ARPreply packet to the target is sent to the target as above, the spoofed ARP table should be recovered.

4. How to use WinArpSpoofer

This section describes the installation and usage of WinARpSpoofer program.

4.1 Software requirement

4.2 Installation

  1. Install the WinPcap driver.
  2. Run WinArpSpoofer.

4.3 Using WinArpSpoofer

Figure 2 is the user interface of the WinArpSpoofer program; this section describes function of the buttons as follows.

4.3.1 Function descriptions

Figure 2: WinArpSpoofer Screen Snapshot

Figure 3: Adapter Snapshot of Options

Figure 4: Spoofing Snapshot of Options

Button Function/Description
Opens the saved hosts.
Saves the contents in the list.
Scans the active computer hosts on the Local Area Network. It can scan C Class, 255 hosts at one time. By thread processing, the results are displayed in a ListBox in a short time (~1–2 seconds). After you click the Scan button, you click the "Start" button.
Starts spoofing the ARP tables of the computers displayed in the ListBox. As to the poisoning of the ARP cache against the remote computers, the MAC address of the gateway is changed to the attacker's MAC address. The method to prove this is to type "arp -a" on the target computer. This function has also the features that this program acts as a router while spoofing and pulling all the packets on the LAN. Because of this, although ARP spoofing happens on the LAN, Internet use of the target computer is no problem. While spoofing, the Stop button is enabled.
If the "Start" button is pressed, the "Stop" button will be enabled. While the "Stop" button is enabled, it keeps spoofing. The "Stop" function recovers the spoofed ARP table. Although the "Stop" function isn't run, most of ARP tables are recovered in a normal time (about 30 seconds). In addition, while "Stop" is enabled, the "Scan" and "Options" buttons can't be pressed.
Sets the option value of this program.
Downloads the latest version of this program.
Describes the features and the basic system requirements.
As one of spoofing types by default, intercepts and forwards all the packets to and from the gateway.
As one of spoofing types, intercepts and forwards all the packets to the gateway.
As one of spoofing types, intercepts all the packets from the gateway and forwards them to the target computer.

5. Using CBuildPacket Class

5.1 Overview

CBuildPacket is designed to send the built ARP, TCP, and ICMP packets to the network. There are many libraries or components such as Libnet and so forth on the Internet, but they have some weak points such as decreasing readability. So, this class is developed. The source of CBuildPacket will be opened.

5.2 Member functions

  • OpenAdapter( ): Opens an adapter of the local computer.
  • BuildARP( ): Builds an ARP packet.
  • SendPacket( ): Sends the built packet to the network.
  • CloseAdapter( ): Closes the opened adapter.
  • ConvertMACStrToHex( ): Converts a string MAC address to a 6-byte MAC hexed value.

5.2 ARP Spoofing code by using CBuildPacket

#include <packet32.h>
#include <BuildPacket.h>

CString Target;        // Ethernet Address of Target
CString Attacker;      // Ethernet Address of Attacker
CString Gateway;       // Ethernet Address of Gateway
CString TargetIP;      // IP Address of Target
CString AttackerIP;    // IP Address of Attacker
CString GatewayIP;     // IP Address of Gateway
CString TargetMAC;     // MAC Address of Target
CString AttackerMAC;   // MAC Address of Attacker
CString GatewayMAC;    // MAC Address of Gateway
.
.
.
void SpoofApp::SpoofTarget()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REQUEST     // for Transmission on MAC
                                          // layer
     GatewayIP, AttackerMAC,              // Spoof IP address of
                                          // Gateway to Attacker IP
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();      // Send a packet to network
   arpPacket.CloseAdapter();    // To close the adapter
}

5.3 Causing same IP address to collide by using CBuildPacket

void SpoofApp::CollideTargetIP()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REQUEST     // for Transmission on MAC
                                          // layer
      TargetIP, AttackerMAC,              // Collision because source
                                          // TargetIP is dest TargetIP
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();                // Send a packet to network
   arpPacket.CloseAdapter();              // To close the adapter
}

5.4 Unspoofing code by using CBuildPacket

void SpoofApp::UnspoofTarget ()
{
   CBuildPacket *arpPacket = new CBuildPacket;

   arpPacket.OpenAdapter( AdapterName );  // To open an adapter
   arpPacket.BuildARP(                    // To build a ARP packet
      Attacker, Target, ARPOP_REPLY       // for Transmission on MAC layer
      GatewayIP, GatewayMAC,              // To recover spoofed ARP Table
      TargetIP, TargetMAC                 //
   );
   arpPacket.SendPacket();                // Send a packet to network
   arpPacket.CloseAdapter();              // To close the adapter
}

6. Conclusion

This article has explained what ARP Spoof is and how to use WinArpSpoof based on CBuildPacket. I believe that the WinArpSpoof program will be a strong Windows-based ARP spoofer program with GUI.

References

http://www.nextsecurity.net/
http://winpcap.polito.it/
http://www.ietf.org/rfc/rfc0826.txt

Document History

Date Description Editor
2004-03-16 Version 0.1 n
  • This program is released.
Gordon Ahn
2004-04-14 Version 0.2
  • User Interface has been newly updated.
  • The each active host can be selected or deselected.
  • Added the live update feature.
  • The contents in the list can be saved to or opened from a file.
  • The feature of acting as a router can be toggled.
Gordon Ahn


Downloads

Comments

  • Can you upload the complete source code for WinArpSpoof

    Posted by iakov on 04/08/2013 11:34pm

    Ccan you upload the complete source code for WinArpSpoof, complete with main function so that it is able to run successfully?when i tried to modify the program, i can compile successfully but unable to run. Thanks in advance.

    Reply
  • malicious?

    Posted by Manni HV on 05/14/2007 03:55am

    What is this good for except helping others doing malicious things? Why should one spread methods how to "attack" and "collect userIDs/password"? I think it would be much better to work on how to avoid such things!

    Reply
  • full program..

    Posted by ling7 on 03/01/2007 07:23am

    can you upload the complete source code for WinArpSpoof, complete with main function so that it is able to run successfully?when i tried to modify the program, i can compile successfully but unable to run. Thanks in advance.

    • there are sm bug!!

      Posted by lyqx888 on 06/05/2007 12:31am

      OMG!!!

      Reply
    Reply
  • full program..

    Posted by ling7 on 03/01/2007 07:17am

    can you upload the complete source code for WinArpSpoof, complete with main function so that it is able to run successfully?when i tried to modify the program, i can compile successfully but unable to run. Thanks in advance.

    Reply
  • full program..

    Posted by ling7 on 02/28/2007 12:50pm

    can you upload the complete source code for WinArpSpoof, complete with main function so that it is able to run successfully?when i tried to modify the program, i can compile successfully but unable to run. Thanks in advance.

    Reply
  • thnxxxxxxxxxxxx

    Posted by b" M0H b" on 01/27/2007 02:27pm

    thnxxxxxxxxxxxxxxxxxxxxxxx

    Reply
  • 1b4Y82@L6u...

    Posted by kkamanne on 02/02/2005 12:54am

    sdaf

    Reply
  • iphlpapi

    Posted by Bruno Leclerc on 04/01/2004 02:52am

    UnenableRouter entry point in iphlpapi.dll when starting winarpspoof in NT4.

    • Can you check out the version of iphlpapi.dll

      Posted by tachyon on 04/02/2004 05:53pm

      or Can you send me the iphlpapi.dll? I want to check out the file. Thank you for using this program -- Gordon

      Reply
    Reply
Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • On-demand Event Event Date: September 10, 2014 Modern mobile applications connect systems-of-engagement (mobile apps) with systems-of-record (traditional IT) to deliver new and innovative business value. But the lifecycle for development of mobile apps is also new and different. Emerging trends in mobile development call for faster delivery of incremental features, coupled with feedback from the users of the app "in the wild." This loop of continuous delivery and continuous feedback is how the best mobile …

  • Packaged application development teams frequently operate with limited testing environments due to time and labor constraints. By virtualizing the entire application stack, packaged application development teams can deliver business results faster, at higher quality, and with lower risk.

Most Popular Programming Stories

More for Developers

Latest Developer Headlines

RSS Feeds