🔐 Project 01 — Packet Sniffing & ARP Spoofing Lab¶

Type: Attack lab (Linux VMs) Modules: 03 (Sniffing, Spoofing & MITM) Difficulty: ⭐⭐

🎯 Objective¶

Passively sniff traffic on a shared LAN segment to recover credentials from a plaintext protocol, then actively poison a victim's ARP cache to redirect its traffic through the attacker machine.

🛠 Setup¶

Three Linux VMs on the same virtual network (VirtualBox/VMware host-only or internal network, or SEED Labs' pre-built Ubuntu VMs cloned three times):

VM	Role	Notes
Attacker	Runs Wireshark/tcpdump, `arpspoof`/`ettercap`, and Scapy	Needs promiscuous-mode capture enabled on its NIC
Victim	A normal client host	Will send traffic to the Gateway; runs a plaintext client (e.g. `telnet` or `ftp`)
Gateway/Router	Stands in for the default gateway	Can be a third VM with IP forwarding enabled, or your virtual network's built-in router

Confirm all three VMs can ping each other before starting, and note each one's IP and MAC address (ip a, arp -a).

🧩 Tasks¶

🔹 Part A — Passive Sniffing¶

On the Attacker VM, start a capture with tcpdump -i eth0 -w capture.pcap (or open Wireshark directly on the interface).
From the Victim VM, connect to a plaintext service on the Gateway (or a fourth "server" role if available) using Telnet or FTP, and log in with a test username/password.
Stop the capture and open it in Wireshark. Use Follow → TCP Stream to locate the session and extract the plaintext username/password.
Note which protocol fields exposed the credentials, and why encryption (e.g. SSH/FTPS) would have prevented this.

🔹 Part B — ARP Cache Poisoning¶

On the Attacker VM, enable IP forwarding so the Victim's connectivity survives the attack:
```
sudo sysctl -w net.ipv4.ip_forward=1
```
Use arpspoof (or ettercap -T -M arp:remote) to poison the Victim's ARP cache so it associates the Gateway's IP with the Attacker's MAC:
```
sudo arpspoof -i eth0 -t <victim_ip> <gateway_ip>
```
On the Victim, check arp -a before and after — confirm the Gateway's MAC entry now matches the Attacker's MAC.
Re-run a capture on the Attacker VM and confirm the Victim's traffic to the Gateway is now visible there (the MITM position).
Optionally, spoof in both directions (arpspoof ... -t <gateway_ip> <victim_ip>) for a full bidirectional MITM.

✅ Verification Checklist¶

Captured a plaintext credential exchange and identified it in Wireshark.
Victim's ARP table shows the Gateway IP mapped to the Attacker's MAC after the attack.
Victim retains internet/Gateway connectivity throughout (IP forwarding confirmed working).
Attacker's capture shows Victim ↔ Gateway traffic flowing through the Attacker.
Explained why ARP has no authentication and how that enables this attack.

📦 Deliverables¶

A short write-up (1–2 pages) describing what was captured and observed, with the recovered credential redacted/blurred in any screenshots.
The exact arpspoof/ettercap commands (or custom Scapy script) used, with a brief explanation of each argument.
Before/after arp -a output from the Victim VM.

🚀 Stretch Goals¶

Write a custom Scapy script that crafts and sends spoofed ARP replies from scratch, without relying on arpspoof.
Add a MITM HTTP downgrade demonstration: intercept a plaintext HTTP login form during the ARP-spoofed MITM position and extract the submitted credentials.
Detect the attack: run arpwatch or a simple Scapy sniffer on the Victim to flag unsolicited/duplicate ARP replies.

See also notes: [[03-01-packet-sniffing-basics]], [[03-04-arp-spoofing-attacks]], [[03-05-mitm-attacks-and-defenses]]