Lab: ARP Poisoning & Packet Sniffing - EHE

Ethical & Legal Warning This lab simulates ARP poisoning and packet sniffing in an isolated, fictional environment for educational purposes only. Performing these techniques against real networks without explicit written authorization is illegal under the Computer Fraud and Abuse Act and equivalent laws worldwide. Only perform these activities in authorized lab environments or with documented permission.

kali@pentester — bash — 80x24 Terminal 1

NovaCorp Assessment — Internal Network 10.0.1.0/24

Target: 10.0.1.50 (workstation) | Gateway: 10.0.1.1

pentester@kali:~$

arp http ftp dns tcp POST only tcp.port==80

No.	Time	Source	Destination	Protocol	Length	Info

Select a packet above to inspect its layers.

Hex dump will appear here.

Progress 0 / 8

Enable IP forwarding on the attacker machine
Start ARP poison against the target (10.0.1.50)
Capture network traffic with tcpdump
Open captured packets in the analyzer
Filter for ARP and identify the poisoning packets
Filter for HTTP and locate the login POST request
Extract the plaintext HTTP credentials
Find the FTP credentials in the capture

Use: echo 1 > /proc/sys/net/ipv4/ip_forward
This tells the kernel to forward packets rather than dropping them.

Run arpspoof -i eth0 -t <target> <gateway>. You need two directions — spoof the target and spoof the gateway.

Filter by http.request.method==POST to isolate the login POST, then expand the HTTP layer in the detail pane to see form data.