0

I'm attempting an MTIM attack on my home LAN just for fun. I am using arpspoof which comes pre-installed with the Linux distribution I'm using. The problem I'm having is I can see the server to client traffic, but not client to server traffic.

These are the IP Addresses in use:

  • Attacker: 192.168.0.4
  • Victim (my phone): 192.168.0.2
  • Gateway: 192.168.0.1

Here are the commands I use for the MitM attack:

  1. Enabling IP-Forwarded in my attacking machine by using this command:

    echo 1 > /proc/sys/net/ipv4/ip_forward

  2. Now I use an arpspoof command to tell the computers I'm the gateway:

    arpsoof -i eth0 -t victimip gatewayip
arpspoof -i eth0 -t gatewayip victimip

  3. Then I start Wireshark, which is where I'm unable to see client-to-server traffic.

Am I missing a step?

xorist
  • 870
  • 4
  • 15
Utkarsh Agrawal
  • 493
  • 1
  • 8
  • 15

2 Answers2

1

There's a typo in your first arpspoof command (missing the p)

arpspoof -i eth0 -t victimip gatewayip

Check if that command is failing. If so it would prevent you from intercepting I need direction of traffic like you're observing.

Daisetsu
  • 5,110
  • 1
  • 14
  • 24
-1

Your router is probably immune to ARP poisioning in this case. Your given IPs suggest, that they are statically assigned to your devices. So your Router has a mapping of MAC-to-IP-address.

There is no reason for your router to pay attention to packages, claiming that a given IP is now used by a different MAC address. Maybe try it using DHCP (this is not guaranteed to work either).

GxTruth
  • 963
  • 6
  • 9
  • 2
    How do the IP addresses he's given suggest that they're statically assigned? I've seen plenty of routers of which have a DHCP server handing out addresses immediately after the typical default gateway address of 192.168.0.1.. I'm not sure this quite answer's the OP's question, maybe his router just doesn't update it's ARP table until certain requirements are met? "immune" is a pretty strong word to use around here. – xorist Oct 05 '18 at 17:50