Network Security Exploitation & Mitigation: ARP Poisoning, TCP, and DNS Spoofing Attacks

Task 1 .1— ARP Cache Poisoning

Objective: The goal is to perform an ARP cache poisoning attack, where Host M intercepts communication between Host A and Host B by poisoning their ARP caches.

Step 1: Task Environment Setup

1. Set Up Containers: Create three Docker containers (Host A, Host B, Host M) as shown in the figure. These containers must be on the same LAN for the ARP poisoning attack to work.
2. Check IP and MAC Addresses: For each container (A, B, and M), open a terminal and run ifconfig to note down the IP and MAC addresses of each container's network interface.

Network Setup

Build the container image

Start the containers

To find the ID of the containers

Start the shell on particular container

IP and MAC Address of each container

Step 2: ARP Cache Poisoning

1. Modify the task1_1.py Script: Inside the SEEDLab VM, modify the task1_1.py script to send an ARP packet from Host M targeting Host A. The packet should map Host B's IP address to Host M's MAC address, poisoning Host A's ARP cache.
2. Execute the Script on Host M: Once the script is modified, execute it in Host M using the command: python3 /volumes/task1_1.py

The modified task1.py file will target container A to add a fake entry to its ARP cache, such that B’s IP address is mapped to M’s MAC address.

Launching the attack

B’s IP Address is mapped to M’s MAC Address

Task 1 .2 — MITM Attack on Telnet using ARP Cache Poisoning

Step 1: Launch ARP Cache Poisoning Attack

1. Host M will conduct an ARP poisoning attack on Hosts A and B. This will make Host M the intermediary for packets between A and B.
2. In Host A’s ARP cache, B’s IP address will map to M’s MAC address, and vice versa for B’s ARP cache.
3. Edit and execute the script task1_2_1.py in container M using the command: python3 /volumes/task1_2_1.py

Telnet B from A

Launch the attack

Step 2: Testing (Without IP Forwarding)

1. Ensure that IP forwarding is off on Host M with the command: sysctl net.ipv4.ip_forward=0
2. On Host A, ping Host B using:ping -c20 <B’s IP>
3. Capture Wireshark results and note any anomalies during the ping test.

Ping from Host A to B when IP Forwarding on Host M is turned off.

Wireshark Analysis

Step 3: Turn On IP Forwarding

1. Enable IP forwarding on Host M using: sysctl net.ipv4.ip_forward=1
2. Repeat Step 2 and observe the changes in the ping test and network traffic.

Ping from Host A to B when IP Forwarding on Host M is turned on.

Wireshark Analysis

Step 4: Launch MITM Attack (Modify Telnet Data)

1. Keep IP forwarding enabled to establish the Telnet connection from A to B.
2. Turn off IP forwarding on Host M with:sysctl net.ipv4.ip_forward=0
3. Type on A’s Telnet window and observe the behavior.
4. Modify the task1_2_2.py script on Host M to spoof the Telnet data. For packets from A to B, replace each typed character with a fixed character (e.g., Z). Leave packets from B to A unchanged.
5. Run the modified script and verify the changes by typing on A’s Telnet window.

task1_2_2.py

When IP Forwarding is OFF and we are running task1_2_1.py and task1_2_2.py

For every keystroke typed in A’s telnet window, each typed character is replaced with ‘z’ on Telnet Server B.

Task 1.3: Modifying Netcat Messages Using ARP Cache Poisoning

1. Start Netcat Communication: On Host B (Server, IP: 10.9.0.6), run nc -lp 9090. On Host A (Client), connect using nc 10.9.0.6 9090.
2. Launch ARP Cache Poisoning: Modify task1_1.py to poison A and B’s ARP caches. Execute on Host M: python3 /volumes/task1_1.py. Verify with arp -a on A and B.
3. Modify Netcat Traffic: Edit task1_3.py to replace your first name with A’s. Run on Host M: python3 /volumes/task3.py. Test by sending messages from A; check B for modifications.

On container B (server)

On container A (Client)

task1_3.py (python script replaces every occurrence of my first name (Archana) in the message with a sequence of A’s.)