A reconnaissance tool that analyzes ARP requests to identify hosts that are likely communicating with one another, which is useful in those dreaded situations where LLMNR/NBNS aren't in use for name resolution.
Requirements/Installation
This is only gon' work on Kali or other Debian-based Linux distributions
eavesarp
requires Python3.7 and Scapy. After installing Python, run the following to install Scapy: python3.7 -m pip install -r requirements.txt
General Usage
Capturing ARP Requests
Notes:
eavesarp
requires root privileges to sniff from the interface and craft ARP packets.- Captured output is automatically written to disk under the name
eavesarp.db
to prevent having to recapture ARP requests.
Passive Execution
The most basic form of execution is:
sudo ./eavesarp.py capture -i eth1
This will initialize eavesarp
such that ARP requests will be captured, analyzed, and relevant output will be presented to the user in a table. Use --help
for additional information on non-standard arguments. Note that the stale column indicates [UNCONFIRMED]
when an ARP request originating from a target (as a sender) has not yet been observed when running in this mode. Enable ARP resolution via the -ar
flag to determine if a given target address has gone stale. ___ ___ __ _____ ___ ___ ________
/ -_) _ `/ |/ / -_|_-</ _ `/ __/ _ \
\__/\_,_/|___/\__/___/\_,_/_/ / .__/
-----------------------------/ /---
[LISTEN CAREFULLY] /_/
Capture interface: eth1
ARP resolution: disabled
DNS resolution: disabled
Requests analyzed: 65
SNAC Sender Target ARP# Stale
------ ------------- -------------- ------ -------------
192.168.86.5 192.168.86.101 29 [UNCONFIRMED]
192.168.86.3 1
192.168.86.3 192.168.86.37 25 [UNCONFIRMED]
192.168.86.38 7 [UNCONFIRMED]
192.168.86.5 1
192.168.86.99 1
192.168.86.99 192.168.86.3 1
Active Execution (ARP Resolution, DNS Resolution)
Enable ARP and DNS resolution by including the
-ar
and -dr
flags. Keep in mind that this makes the tool non-passive, but the advantage is that DNS records, MAC addresses, and a confirmation of SNACs status is returned.sudo ./eavesarp.py capture -i eth1 -ar -dr --blacklist 192.168.86.5
We can clearly see from the output below which senders are affected by one or more SNACs and the affected addresses. The final column indicates if a potential MITM opportunity is present. eavesarp
checks to see if the FWD address of the PTR resolved for a given sender is different. If so, it may be an indicator that the intended target has moved to the new FWD address. Applying an alias to the interface of our attacking host may allow us to forward the traffic to the intended target and capture information in transit. ___ ___ __ _____ ___ ___ ________
/ -_) _ `/ |/ / -_|_-</ _ `/ __/ _ \
\__/\_,_/|___/\__/___/\_,_/_/ / .__/
-----------------------------/ /---
[LISTEN CAREFULLY] /_/
Capture interface: eth1
ARP resolution: enabled
DNS resolution: enabled
Requests analyzed: 55
SNAC Sender Target ARP# Stale Sender PTR Target PTR MITM
------ ------------- -------------- ------ ------- -------------- ---------------- ---------------------------------------------
True 192.168.86.2 192.168.86.101 21 True iron.aa.local. syslog.aa.local. T-IP:192.168.86.101 != PTR-FWD:192.168.86.102
True 192.168.86.3 192.168.86.38 17 True crux.aa.local.
192.168.86.37 15 True
192.168.86.99 1 w10.aa.local.
192.168.86.99 192.168.86.3 1 w10. aa.local. crux.aa.local.
Analyzing PCAP Files and SQLite Databases (generated by
eavesarp
)eavesarp
can accept SQLite databases and PCAP files for analysis. It will output the extracted values to a new database file for further analysis. See the --help
flag for more information on this process, however basic execution is demonstrated below.sudo ./eavesarp.py analyze -sfs eavesarp.db -cp disable --blacklist 192.168.86.5 --csv-output-file eavesarp_analysis.db
SNAC Sender Target ARP# Stale Sender PTR Target PTR MITM
------ ------------- -------------- ------ ------- -------------- ---------------- ---------------------------------------------
True 192.168.86.2 192.168.86.101 21 True iron.aa.local. syslog.aa.local. T-IP:192.168.86.101 != PTR-FWD:192.168.86.102
True 192.168.86.3 192.168.86.38 17 True crux.aa.local.
192.168.86.37 15 True
192.168.86.99 1 w10.aa.local.
192.168.86.99 192.168.86.3 1 w10.aa.local. crux.aa.local.
- Writing csv output to eavesarp_analysis.db
...and the CSV output looks like...arp_count,sender,sender_mac,target,target_mac,stale,sender_ptr,target_ptr,target_forward,mitm_op,snac
21,192.168.86.2,74:d4:35:1a:b5:fb,192.168.86.101,[STALE TARGET],True,iron.aa.local.,syslog.aa.local.,192.168.86.102,T-IP:192.168.86.101 != PTR-FWD:192.168.86.102,True
17,192.168.86.3,b8:27:eb:a9:5c:8f,192.168.86.38,[STALE TARGET],True,crux.aa.local.,,,False,True
15,192.168.86.3,b8:27:eb:a9:5c:8f,192.168.86.37,[STALE TARGET],True,crux.aa.local.,,,False,True
1,192.168.86.99,08:00:27:22:49:c5,192.168.86.3,b8:27:eb:a9:5c:8f,False,w10.aa.local.,crux.aa.local.,192.168.86.3,False,False
1,192.168.86.3,b8:27:eb:a9:5c:8f,192.168.86.99,08:00:27:22:49:c5,False,crux.aa.local.,w10.aa.local.,192.168.86.99,False,True
via KitPloit
Related articles
- Computer Hacker
- Hacking Tools For Windows 7
- Black Hat Hacker Tools
- Hacker Tools Apk Download
- Pentest Tools Find Subdomains
- Github Hacking Tools
- Hacking Tools Github
- Hak5 Tools
- Hack And Tools
- Pentest Tools Apk
- Hacking Tools Software
- Pentest Tools Find Subdomains
- Hacking Tools Mac
- Hacking Tools 2019
- Hacking Tools For Beginners
- Pentest Tools Free
No comments:
Post a Comment