DOS Attack By ARP Poisoning

In the previous post we have been discussing the arp protocol (if you havent read it go here and read it) we saw theoretically how one can poison other's arp table on his LAN and disconnect him from the Internet. Here, you will see how one can cut others internet connection on a LAN.
We will use a tool called nemesis on a linux machine, the download link is given at the bottom. Nemesis is a packet injection tool, means you can create forged packets using it.
Usually the OS automatically replies for arp requests, the kernel usually fills the header with the correct values and automatically sends it. But with the help of nemesis we can create packets with manipulated contents, not only the body of packets but also the header. So if we want to send a spoofed arp reply, we can.
So you should find your target's ip address, this is not the public ip which is same for both of you. To find the active computers on your network you can use the ping command in a loop.
Here is a bash script for it, refer towards the end of the post if you dont know how to execute the code.

The ip 192.168.11 is that of the network which i am using. Replace it with that of your network.
The command ifconfig will help you to find the ip address of your network.

Now execute it. Now wait a few seconds to get the list of hosts who are alive at the moment. Now you should choose a host to perform the attack. Ignore the '1' which is usually the gateway.
And here is another bash script to perform the attack.
Here 'eth0' is my ethernet interface, you can find your by using the ifconfig command. '192.168.11.' is the ip address of my network and 20 is the ip of the host which i want attack. You should replace these values with apropriate ones.
What the script does is, it sends arp reply to 192.168.11.20 saying the mac address of the gateway(192.168.11.1) is '0:1:2:3:4:5' but it is not the actual one but something rubbish(use the command arp on the terminal to see your arp table) and his arp table becomes poisoned, similarly it poisons the arp table of the gateway, these steps are executed in a loop. Since the packets destined for them are having false mac address as destination, adapters at both the systems ignore the packets and both of them cannot communicate with each other, hence  '192.168.11.20' looses his internet connection. After executing it, on success you will get messages saying this

ctrl+z can be used when you want to stop the execution of the script.

To execute the bash script, copy it and paste it in plain text editor and name it as "anyname.sh". Now use cd command to browse to the location of the file, and use the following command to make it executable
sudo chmod +x anyname.sh
Now simply use the command
./anyname.sh

For installing nemesis, you can download the binaries from here
If  "libnet-1.0.2a" is not installed in your system you should install it before  nemesis. Click here to download it.
If you don't how to compile and install these binaries then use google.


tags:-arp, poisoning, DOS, nemesis, ping, host, scan, ping, mitm