eavesarp: analyzes ARP requests
A reconnaissance tool that analyzes ARP requests to identify hosts that are likely communicating with one another, which is useful in those dreaded situations where LLMNR/NBNS aren’t in use for name resolution.
git clone https://github.com/arch4ngel/eavesarp.git
python3.7 -m pip install -r requirements.txt
Capturing ARP Requests
- eavesarp requires root privileges to sniff from the interface and craft ARP packets.
- The captured output is automatically written to disk under the name
eavesarp.dbto prevent having to recapture ARP requests.
The most basic form of execution is:
sudo ./eavesarp.py capture -i eth1
This will initialize eavesarp such that ARP requests will be captured, analyzed, and relevant output will be presented to the user in a table. Use –help for additional information on non-standard arguments. Note that the stale column indicates [UNCONFIRMED] when an ARP request originating from a target (as a sender) has not yet been observed when running in this mode. Enable ARP resolution via the -ar flag to determine if a given target address has gone stale.
Active Execution (ARP Resolution, DNS Resolution)
Enable ARP and DNS resolution by including the -ar and -dr flags. Keep in mind that this makes the tool non-passive, but the advantage is that DNS records, MAC addresses, and confirmation of SNACs status is returned.
sudo ./eavesarp.py capture -i eth1 -ar -dr --blacklist 192.168.86.5
We can clearly see from the output below which senders are affected by one or more SNACs and the affected addresses. The final column indicates if a potential MITM opportunity is present.
eavesarp checks to see if the FWD address of the PTR resolved for a given sender is different. If so, it may be an indicator that the intended target has moved to the new FWD address. Applying an alias to the interface of our attacking host may allow us to forward the traffic to the intended target and capture information in transit.
Analyzing PCAP Files and SQLite Databases (generated by eavesarp)
eavesarp can accept SQLite databases and PCAP files for analysis. It will output the extracted values to a new database file for further analysis. See the –help flag for more information on this process, however, basic execution is demonstrated below.
sudo ./eavesarp.py analyze -sfs eavesarp.db -cp disable –blacklist 192.168.86.5 –csv-output-file eavesarp_analysis.db
…and the CSV output looks like…
Copyright (c) 2019 Justin Angel