ARP Poisoning

IP addresses are used in communication between networks (layer 3, routers). MAC addresses are used in communication within a local network (layer 2, switches). The ARP table is used to maintain a correspondence between IP addresses and MAC addresses within a local network, which is necessary for routing packets. ARP tables are updated every time an ARP response is received, even if no request has been sent to them. ARP table poisoning attacks aim to manipulate victims' ARP tables by sending spoofed packets, such as packets with modified MAC addresses, to insert false MAC-IP associations.

Ettercap

GUI.

• Scan hosts.

• Select targets (or even just one) and add them to the scope.

• Start one-way ARP poisoning or sniff.

Bettercap

Command-line.

sudo bettercap

set arp.spoof.internal true
# spoof also internal network communications, not just external

set arp.spoof.targets <IP>
# without IP spoofs the whole network

arp.spoof on/off

net.sniff on/off
# sniffing of target connections

GUI.

sudo bettercap -eval "caplets.update; ui.update; q"

sudo bettercap -caplet http-ui 

Default credential: user:pass Change in /usr/share/bettercap/caplets/http-ui.cap