Cybersecurity · ARP Spoofing Lab
ARP Spoofing Lab
ARP poisoning (on-path) with arpspoof in Kali on a segmented LAN, with pre-attack Nmap recon and post-attack Wireshark analysis.
Overview
This lab walks through an end-to-end attack path on a local network:
- Active reconnaissance with Nmap to identify the target and infer OS details.
- ARP spoofing with
arpspoofto position the attacker as on-path (man-in-the-middle). - Traffic analysis in Wireshark to enumerate services and metadata (DNS, NetBIOS, SSDP, etc.).
Environment: Performed in a segmented lab LAN to avoid impacting production systems.
Active Reconnaissance with Nmap
Initiating the ARP Spoofing Attack (arpspoof)
With the target defined, the attacker poisons the ARP cache of the victim and/or gateway to redirect traffic through the attacker’s host.
arpspoof to begin the on-path position.
Analyzing Captured Traffic with Wireshark
Identifying DNS Server IP Address
NetBIOS and Other Host Information
SSDP Enumeration
Other Host Information
