How to ArpSpoof and SslStrip Introduction

---------

Arpspoofing and SSL stripping are powerful tools in the arsenal of any network security enthusiast or penetration tester looking to test an organizations defenses. In this article, we will walk you through a step-by-step guide on how to set up these tools on Ubuntu and then proceed with some basic usage examples.

Prerequisites

----------

Before diving into the meat of things, make sure that your system meets certain requirements:

1. You should be running Ubuntu 16.04 or higher (earlier versions might not work properly).

2. Ensure that you have root privileges; otherwise, many commands will throw 'permission denied' errors.

3. Install `libssl-dev` and `libffi6` by typing the following command in your terminal:

$ sudo apt-get update

$ sudo apt-get install libssl-dev libffi6

Step 1: Setting up ArpspoMan

--------------------------

ArpSpoof is an excellent tool for performing man-in-the-middle (MitM) attacks on local networks. However, it's no longer actively maintained and may not work as expected in newer Ubuntu versions.

Instead of using the outdated `arpspoof` package from the official repositories, we'll be installing ArpsPoMan—a more recent fork that supports modern operating systems including Ubuntu 16.04+. To do so:

1. Add the repository by running the following command (paste it all at once):

$ sudo apt-get update

$ sudo add-apt-repository ppa:ArP5/untangle-testing

2. Update your package index and install ArpsPoMan with these commands:

$ sudo apt-get update

$ sudo apt-get install arpspoof

Step 2: Setting up SSLStrip

--------------------------

SSLstrip is another essential tool in any penetration tester's arsenal, designed specifically for bypassing HTTPS encryption on web browsers that do not properly implement the 'Strict Transport Security' (HSTS) header.

To set it up:

1. Clone or download the latest version of sslstrip from its official repository using Git by running these commands:

$ git clone https://github.com/ajinomoto/sslstripy.git

$ cd sslstripy

2. Build and install SSLStrip with the following command :

$ ./configure --prefix=/usr/local/

$ make && sudo make install

Step 3: Basic Usage Examples

--------------------------

### Arpspoofing Example

1. Start a new terminal session as root or simply type `su -` followed by your password to switch to the superuser.

2. Bring up an interface (e.g., eth0) in promiscuous mode:

$ sudo ip link set dev eth0 up

3. Arpspoof all devices on this network with MAC address `00:11:22:33:44:66` and your own IP address of 192.168.1.100 as their default gateway, while also spoofing traffic from any device to the same target:

$ sudo arpspoof -D -r eth0 192.168.1.*

4. To see all ongoing connections (use `Ctrl + C` to exit):

### Sslstrip Example

1. Start a new terminal session as root or switch to an existing one where you have privileges.

2. Navigate into the directory where you cloned/extracted SSLStrip.

3. Run sslstrip in transparent mode against any HTTPS site (e.g., www.example.com) on port 443:

$ ./sslstripy -p 80 -k secret --cert /path/to/cacert.pem https://www.example.com

-------

In conclusion, arpspoofing and SSL stripping are powerful tools that can be used for both good (testing purposes) or evil. Always remember to use them responsibly and only after obtaining proper permission from the network administrators before conducting any sort of penetration testing on production networks without explicit consent!

Hope this article has been informative enough! If you have any further questions or need more information about these topics, feel free to ask in the comments section below.

Happy hacking!

Your friendly neighborhood security enthusiast.

How to arpspoof and sslstrip