Skip to content

Python script for ARP poisoning, expanded from a book example for class project

Notifications You must be signed in to change notification settings

moore-drew/ARP_poison

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 

Repository files navigation

1. Setup and Dependencies: project uses the Scapy python library (https://github.com/secdev/scapy).  i've included the library in the ./scapy/ folder.  ./pyx/ is a Scapy dependency library, and pyx depends on TexLive or MikTeX, both of which can be obtained through Aptitude (apt install texlive-latex-base).

before running arper.py, you must make sure that ip forwarding is enabled; you can check this through "$ cat /proc/sys/net/ipv4/ip_forward".  if a '1' is not returned, then run the following command: "# echo 1 > /proc/sys/net/ipv4/ip_forward"

2. Usage: super user privileges are required to run the program, as it interacts with sockets.  you can run the program as "sudo python arper.py" with no arguments and it will use my default settings (interface="wlp3s0" target_ip="192.168.1.148" gateway_ip="192.168.1.1" packet_count=50), or as "sudo python arper.py <interface name> <target ip> <gateway ip> <# of packets until repairing ARP and terminating>".  IMPORTANT: because of time constraints, i only have included a checker for the number of arguments and making sure that the packet count converts into a valid integer type, not for the interface name, or IP values; this means the program will attempt to pass protocols to those IPs or interfaces.  an IP not responding to a ARP request is handled, but not if the string is just not of the correct format.

the output of the program is a captured packet file called "arper.pcap".  wireshark interprets the file as it should.

the program can be safely terminated with Ctrl+C, as when it receives the input it repairs the ARP poisoning before exiting, as it would normally do.

3. Limitations: due to time constraints and the lack of complete and formal library documentation i was not able to do all of what i originally had planned.  it does successfully perform ARP poisoning, but it does not forward packets from the target IP to their original destinations or packets to IP from other outside sources.  however, as a consequence it is able to simply block the target from the router, effectively cutting off it's internet connection, while also capturing the packets that were sent from the target and saving them for later investigation.

4. Included .pcap File: there is a sample output .pcap file i have included, "sample_output.pcap", which is the result of me targeting my phone (which i made sure only had a Wifi connection at the time).  when the capture was started i was sitting idle on "cofc.edu", and then attempted to click a hotlink to "library.cofc.edu".  i then waited a few seconds, canceled the page request, and then clicked the link again.  the program captured the amount of packets i had set, 50, then repaired the ARP poisoning and saved the file.  the phone then was able to connect to "library.cofc.edu" without having to reconnect to my Wifi or anything else.  a video is included (let me know if it plays on your system... had issues finding decent video recording and editing software off of apt).

About

Python script for ARP poisoning, expanded from a book example for class project

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages