Hello, my name is Stefan.
Welcome to another awesome lecture.
So in previous lecture we mentioned what an address resolution protocol is, and in this lecture we
will look at it in more depth.
So in the local network, communication takes place between devices using Mac addresses instead of IP
addresses.
So there are also called link layer addresses.
So ARP is a request response protocol, which means that one device requests a service and other one
replies in response to that request.
So suppose that we two devices are present in a network with no external internet connectivity here.
Actually, we had the we had diagram of this here.
So suppose we have.
And we have two devices here, which is Taiwan's device and this device with no Internet external Internet
connectivity.
So for them to communicate with each other, they need to rely on an underlying protocol, which is
known as the Layer two protocol.
So we already briefly learned about ARP tables.
So by using a table, the device can maintain a list of all the devices on a network by using mapping
of their IP and Mac addresses.
So this is the this is the regular ARP table would look like here ARP catch in first place ARP catch
Mac address in second place.
And as you can see we have all the ARP tables of so the Windows 11 has a router table and the router
here has Typhoon's Windows 11 IP tables here.
So this table technique is quite old and was designed without security considerations in mind.
So it has some inherent weaknesses that can be exploited, as we will see in a later lectures.
But first, let's start about learning about what ARP poisoning is.
So before before we learn, start learning about ARP poisoning.
But let's firstly, let's look at the ARP again.
So ARP is a basically a program on on your Ethernet that's installed on your PC that performs all tasks
related to address resolution protocol automatically without needing to any input from the user.
So to get an address from a machine, it plots f, f, f, f, like like lots of f, six times two f
here, I think here.
So it puts this.
This amount of F's which in Urp here it means broadcast here.
So I want to show you something that we learned in previous lecture.
Let me actually open my Kali and yes, perfect.
So you remember this example that we did in previous lecture here.
Of here.
So as you can see here, we have lots of s.
So this F's mean broadcast in ARP address resolution protocol.
So this s means broadcast.
So let's go to our diagram again.
So we use that F so remember, so here this F as a broadcast address.
So we are sending this F to everywhere and it does this to send to request to all the active devices
in the network while asking the relevant question.
So subsequently the intent intended device replies with an appropriate answer.
So let's look at this diagram here.
So.
Now, here we let's go to the previous diagram that we drew in previous lectures.
And here.
Can you see it?
Yeah, Perfect.
So our first device sends request and device join device replies with an answer along with a mac address.
So looks pretty straightforward.
Right?
So actually there's a design flaw in this protocol.
So when a joins device receives a request.
So if joins device receives a request.
It has no way of knowing whether the information being provided by the requesting device is correct
or not.
So in this way you can easily spoof the packets.
And now let's go to this example here and see what's changing here.
Right.
So here, actually, let me make it a bit down here so we can see in zoomed mode.
Can you see it clearly?
Yes.
Perfect.
And now.
Let's consider a scenario here.
So let's say our telephones device wants to communicate with an Internet based device.
As we already know, it can't directly connect to the Internet by self, right?
It can't connect to the Internet by by itself.
So it must go through the gateway First the router and then router connects to this.
Right?
So.
The corresponding IP and Mac addresses of the device are shown here.
So the three phones, Windows 11 and the Gateway maintain their own ARP tables.
So for iPhones, Windows 11 to send a request to the external server, it will look inside its own table,
which is here.
This is the iPhone 11 ARP table to find the Mac address of the Gateway device.
And this is the ARP table of this gateway device, right?
So once it successfully finds the device's Mac address and as you can see, it, found it from here.
This is the Mac address of our gateway device.
This is information about our router.
This is information about our computer.
And this is the table as written here.
ARP Catch IP Catch Mac ARP Cash and Cash Mac.
So this here represents the step one in this diagram, as we explained here.
So if there is only one device on the local network, the ARP table in the phones, Windows 11 will
look something like that.
Right?
Ah, so the table in the wise of typhoons, Windows 11 will look something like that.
So now the scientific gateway is a bridge between a local network and the internet.
I will figure out the external IP address for the packet so then using its own external or public IP
address.
As you can see, we have public IP and private IP here.
So but in typhoons, Windows 11, it actually doesn't have a public IP since it has the same router1
IP as the router run.
Right.
So it will they are sharing the same public IP here.
So.
Uh, use using its own external or public IP address.
It will forward the request to the server located at 89.201 point 20.19 and this is the step two.
And the server here will process actual signs.
We are completing this here.
We're going to make this read signs.
This means that we completed these steps here.
So here the step two actually, instead of making it, it will be much explanatory if we make this.
Yellow.
And here.
So this is the step two, right?
So the server will process the request and reply to the router so the server will process the request
and reply to the router.
And this is the step three here and the router will receive this reply and figure out where the external
packet should go to and how does it figure out where the packet should go.
As you may have guessed, it will look at the destination address and destination port.
Uh, using its own table.
It will see where the respective device is located and the the table in the router will look like this.
Here.
It knows our typhoon's Windows 11 IP address and Mac address.
So and in the step four, the router will simply forward the reply to the intended recipients.
So that's it.
This is how our diagram works.
So, so far we have learned how a normal request or response works and now here.
We will add an additional player called Hacker.
Or Pentester.
So we learned about how AARP works in this following way.
As we already know, devices keep connecting and disconnecting indefinitely.
Another and here, since they are keeping, disconnecting and connecting, the AARP program doesn't
keep this table.
A indefinitely.
Right.
Another reason for this is that dynamic host control protocol, the HCP, the HCP.
I think you have heard about this, right?
So the HCP.
So another reason for this is that the dynamic host control protocol, this server, the Http server,
automatically assigns IP addresses to devices in a network.
So when a device goes offline, the IP address becomes available again so that it can be assigned to
a new connected device.
So if our telephones, Windows 11 goes offline and this is the you know, this is the IP address of
typhoons, Windows 11, it it could be given to like, for example, Jonathan's Kali Linux or Jonathan's
Ubuntu here and it could instead of using in the IP address of Windows 11 this
192.1680.1.102 could be given to like Ubuntu system the Jonathan's ubuntu system and whatsoever so.
And as I said, for this reason, the devices in a network periodically send ARP responses to other
devices in the network to let them know of their current IP and Mac addresses here.
So this ensures that all the devices have an updated record of the IP and Mac addresses, and this is
how it's done to make the less complications and like less like errors in the network here.
So.
Now, when a device receives an ERP response, it just updates its ERP table without any authentication
or validation.
So you can see the problem here, right?
So if a device creates an ERP response with a fake information and sends us over to victim or target
machine, the receiving device will update its ERP table with fake information without validating validating
the correctness of the data.
So another weakness in the ERP protocol is that it allows us to accept responses even if it didn't send
a request.
Right?
So now let's look at another diagram here.
Where are the how attackers work?
And now I will explain all of this here right in this lecture.
So I hope you are seeing.
More here.
So now.
So here.
Our.
The.
So here we're going to we have attacker Skull Linux and Windows 11.
Right.
So.
Here.
Attackers color Linux, which belongs to the hacker will generate two fake ARP address resolution protocol
responses.
One for the victim and one for the gateway router.
So it will send an ARP reply to the device of this.
Platforms.
Windows 11.
And pretend to be rather so.
Similarly, it will send a reply to the router and it to the device.
So.
Now.
So it's a simple like as I said, it will go to three phones, Windows 11 and say, Bro, I am a router
and it will go to router bro.
I'm a trust me, I'm a three phones window typhoons, Windows 11, right?
This is how it works pretty layer right so here now both device previous Windows 11 and the router will
update their table with this new fake information.
So now if telephones device makes the no actually if the three phones device.
Right will make the same request as it did in the previous case.
So the external server, instead of requesting going to the router, the request will go to the attacker.
So the attacker can then choose to forward the request to the router.
And at this point the router will think the request is coming from the the from device a.
And.
In reality, the request is coming from our attacker.
Scale Linux device.
Right.
So attacker scale Linux device.
In fact intercepting all the network between the router and device.
So this is how a man in the middle attack type work.
And in the next lecture we will create an example application with this here.
So I'm waiting you in the next lecture.