> For the complete documentation index, see [llms.txt](https://blog.rootkid.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.rootkid.in/exam-prep-notes/junior-penetration-tester-ejptv2-notes/host-and-network-penetration-testing/network-based-attacks/arp-poisoning.md).

# Arp Poisoning

## **ARP Poisoning Overview**

ARP poisoning, also known as ARP spoofing, is a cyberattack where an attacker tricks devices on a network into associating their network traffic with the attacker's device. This is done by sending fake Address Resolution Protocol (ARP) messages, causing the devices to send their data to the attacker instead of the intended recipient. This enables the attacker to intercept, modify, or eavesdrop on the network traffic, potentially leading to data theft or manipulation. It's like tricking the post office into delivering your neighbor's mail to your doorstep.

## **ARP Spoofing Attack Flow**

### **1. Discover IP Addresses on the Network**

* Use a network scanning tool or command to identify all IP addresses connected to your network.
* **Example Command:** `nmap -sP 192.168.1.0/24` (Replace `192.168.1.0/24` with your network range.)

### **2. Select Target IP Addresses**

* Choose the IP addresses of the **target** (the machine you want to intercept traffic from) and the **gateway** or **receiver** (the machine whose traffic you want to redirect).

### **3. Enable IP Forwarding**

* Allow your system to forward packets between different network interfaces.
* **Command:** `echo 1 > /proc/sys/net/ipv4/ip_forward`

### **4. Launch ARP Spoofing Attack**

* Use the `arpspoof` tool to send fake ARP messages to the network, redirecting traffic between the target IP and the receiver IP.
* **Command:** `arpspoof -i <interface> -t <target_ip> -r <receiver_ip>`
  * **`<interface>`**: The network interface you're using (e.g., `eth0`, `wlan0`).
  * **`<target_ip>`**: The IP address of the target machine.
  * **`<receiver_ip>`**: The IP address of the receiver (usually the gateway).

### **5. Capture and Analyze Traffic**

* Ensure that **Wireshark** is running in the background to capture and analyze the network traffic for further examination.
* **Command to Start Wireshark:** `wireshark`

***

***

***

**`Hacker's Mantra:`**`I was interested in computer programming as a kid. In fact, during my college days, I used to be a hacker. - Vatsal Sheth`