[{"createTime":1735734952000,"id":1,"img":"hwy_ms_500_252.jpeg","link":"https://activity.huaweicloud.com/cps.html?fromacct=261f35b6-af54-4511-a2ca-910fa15905d1&utm_source=V1g3MDY4NTY=&utm_medium=cps&utm_campaign=201905","name":"华为云秒杀","status":9,"txt":"华为云38元秒杀","type":1,"updateTime":1735747411000,"userId":3},{"createTime":1736173885000,"id":2,"img":"txy_480_300.png","link":"https://cloud.tencent.com/act/cps/redirect?redirect=1077&cps_key=edb15096bfff75effaaa8c8bb66138bd&from=console","name":"腾讯云秒杀","status":9,"txt":"腾讯云限量秒杀","type":1,"updateTime":1736173885000,"userId":3},{"createTime":1736177492000,"id":3,"img":"aly_251_140.png","link":"https://www.aliyun.com/minisite/goods?userCode=pwp8kmv3","memo":"","name":"阿里云","status":9,"txt":"阿里云2折起","type":1,"updateTime":1736177492000,"userId":3},{"createTime":1735660800000,"id":4,"img":"vultr_560_300.png","link":"https://www.vultr.com/?ref=9603742-8H","name":"Vultr","status":9,"txt":"Vultr送$100","type":1,"updateTime":1735660800000,"userId":3},{"createTime":1735660800000,"id":5,"img":"jdy_663_320.jpg","link":"https://3.cn/2ay1-e5t","name":"京东云","status":9,"txt":"京东云特惠专区","type":1,"updateTime":1735660800000,"userId":3},{"createTime":1735660800000,"id":6,"img":"new_ads.png","link":"https://www.iodraw.com/ads","name":"发布广告","status":9,"txt":"发布广告","type":1,"updateTime":1735660800000,"userId":3},{"createTime":1735660800000,"id":7,"img":"yun_910_50.png","link":"https://activity.huaweicloud.com/discount_area_v5/index.html?fromacct=261f35b6-af54-4511-a2ca-910fa15905d1&utm_source=aXhpYW95YW5nOA===&utm_medium=cps&utm_campaign=201905","name":"底部","status":9,"txt":"高性能云服务器2折起","type":2,"updateTime":1735660800000,"userId":3}]
arp欺骗原理:
当PC1
与PC2通信时,会查询arp缓存表,在没有通信之前arp缓存表是空的,这时PC1没有发往PC2的MAC地址,无法封装数据包进行发送数据,就需要先发送广播的arp请求来获取PC2的MAC地址,当其他PC机收到PC1的ARP请求,便会判断PC1广播来的ARP请求中的目的IP是不是自己的IP,如果是就回应PC1自己的MAC地址。因为PC1是广播ARP请求,所以同时连入网络的攻击者也可以收到arp请求,这时攻击者可以仿造PC2回复给PC1的应答报文,从而让PC1认为前往PC2(192.168.72.20)的MAC地址变为攻击着的mac地址。
实验要求:
PC1和PC2、kali都连入vment8网卡的网段
拓扑图:
环境搭建:
在ensp上,添加一个 cloud,双击打开后,创建一个UDP端口和vment8端口用于实验
实验步骤:
1.在PC1上ping测试PC2和kali,用来将PC2和kali的mac地址放入PC1的ARP缓存表
PC>ping 192.168.72.20
PC>ping 192.168.72.131
2.查看PC1正确的缓存表
在PC1上执行arp -a,可以看到kali的mac地址和PC2的mac地址
3.在kali上执行下图命令
-t 后的第一个IP表示被攻击者,第二个IP表示攻击者要伪装成那个IP(被攻击者要通信的对端IP)
执行后kali会一直回复PC1 192.168.72.20的mac地址是00:0c:29:7f:7b:26(kali的mac) ,从而让pc1
认为PC2是kali
4.查看PC1的arp缓存表
这时前往前往PC2的数据会发送给kali
上面讲解的是单向欺骗,只欺骗了PC1,这时如果PC2是网关,PC1需要通过PC2访问外网,
kali不会将PC1的数据转发,因此现在的PC1会无法上网,在本实验中是无法访问PC2。
现在我们想要PC1的数据经过kali,但是还能够访问PC2,就需要将PC2也欺骗,
5.在kali上欺骗PC2,让PC2以为PC1是kali
在kali上保留之前的终端,重新开启一个终端,执行下图命令,与之前不同的是:IP地址互换了
这时就实现了PC1和PC2可以互相通信,但是数据已经被kali截获。
双向欺骗叫中间人攻击