0

I am having trouble with what seems to be a very simple problem.

I manage to be able to successfully spoof the ARP table of one computer on my network (as reported by arp -a). But even enabling a listener (proxy) on port 80 (supposed to intercept HTTP requests) or even with Wireshark, I was unable to intercept the data from the other computer. What is the simplest of the procedures to be able to see the data which is being sent from the spoofed computer? In there any specific ports I whould be listening to?

Improve this question
6
  • 1
    How did you spoof the ARP table? Are you using some sort of known ARP poisoning technique or did you manually edit the ARP table of the computer? Are you trying to preform a type of 'man-in-the-middle' attack to 'see' the data from the other computer without interrupting traffic flow, or are you trying to completely fake the other computer out?
    – txtechhelp
    Apr 18, 2014 at 7:35
  • As I would very much like to create my own ARP spoofing software, I first downloaded this software codeproject.com/Articles/6579/…. To see if it would work properly. But I couldn't be able to perform a MITM attack, as even Wireshark couldn't intercept a thing. And yes, I wouldn't want to interrupt traffic flow.
    – Bruno Klein
    Apr 18, 2014 at 11:53
  • 1
    Have you been able to use Wireshark to see any traffic on your network without doing the ARP poisoning? If Wireshark isn't able to see anything on the network you're card might not support promiscuous mode (en.wikipedia.org/wiki/Promiscuous_mode). As an aside, if you suspect the code you've written for the ARP spoofer has issues you could ask over at stackoverflow.com; since this question is more in regards to information security than general 'computer help', you can check out security.stackexchange.com too. Your question might get a better answer at one of those
    – txtechhelp
    Apr 18, 2014 at 20:08
  • The problem is not with the code (since the ARP table of one of the computers on the network was correctly changed). Wireshark was able to see all kinds of traffic, just not any from the second computer (victim) on the network.
    – Bruno Klein
    Apr 18, 2014 at 20:50
  • 1
    Take a look at Kali Linux (kali.org); it's a Linux Live CD (it can be installed too), it's a full suite of penetration testing tools (to include MITM software). Unfortunately this comment section is going to get too long and there's not really a 'suitable' answer for your question since it would require getting more in depth on penetration testing and would require too lengthy an answer (in other words: your question is too broad to illicit a valid enough answer). Kali's forums might also help you out in this question.
    – txtechhelp
    Apr 19, 2014 at 1:46

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .