Keep an eye on your arp table

hunt3r972 · 02-22-2014, 03:35 PM

This script will help you to see if something is going wrong in your arp table. It will tell you any modification into this one:

Code:
#!/bin/bash

echo
echo '          _____  _____     _____'
echo '    /\   |  __ \|  __ \   / ____|'
echo '   /  \  | |__) | |__) | | (___  _   _ _ ____   _____ _   _' 
echo '  / /\ \ |  _  /|  ___/   \___ \| | | |  __\ \ / / _ \ | | |'
echo ' / ____ \| | \ \| |       ____) | |_| | |   \ V /  __/ |_| |'
echo '/_/    \_\_|  \_\_|      |_____/ \__,_|_|    \_/ \___|\__, |'
echo '                                                       __/ |'
echo '                                                      |___/' 
echo
echo "By 9H4C7K3R2 - v1.0"
echo "@ Print the arp table and show the modification"
echo "@ It will help you to prevent MITM attacks"
echo
echo "[+] Cleaning iptables"
iptables -F
iptables -X
echo "[+] Dumping arp table"
cp /proc/net/arp .arp_backup.txt
echo "-----------------------------------------"
cat .arp_backup.txt
echo "-----------------------------------------"
cp .arp_backup.txt .IP_MAC.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
        cp /proc/net/arp .IP_MAC_compare.txt
        diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
        if [ -e .result.txt ];
        then
                if [ ! -s .result.txt ]
                then
                        echo "[+] Nothing detected"
                else
                        cp .IP_MAC_compare.txt .log.txt
                        sed -i '1iModification detected' .log.txt
                        echo "[+] Modification detected"

                        mv .IP_MAC_compare.txt .IP_MAC.txt
                        echo "----------------------------------------------------------------------------------"
                        cat .log.txt
                        echo "----------------------------------------------------------------------------------"
                        grep '<' .result.txt
                        grep '>' .result.txt
                        echo "----------------------------------------------------------------------------------"
                fi
        fi
        echo "[+] Wait 30 secs before next check"
        sleep 30
done

hunt3r972 · 02-22-2014, 03:35 PM

This script will help you to see if something is going wrong in your arp table. It will tell you any modification into this one:

Code:
#!/bin/bash

echo
echo '          _____  _____     _____'
echo '    /\   |  __ \|  __ \   / ____|'
echo '   /  \  | |__) | |__) | | (___  _   _ _ ____   _____ _   _' 
echo '  / /\ \ |  _  /|  ___/   \___ \| | | |  __\ \ / / _ \ | | |'
echo ' / ____ \| | \ \| |       ____) | |_| | |   \ V /  __/ |_| |'
echo '/_/    \_\_|  \_\_|      |_____/ \__,_|_|    \_/ \___|\__, |'
echo '                                                       __/ |'
echo '                                                      |___/' 
echo
echo "By 9H4C7K3R2 - v1.0"
echo "@ Print the arp table and show the modification"
echo "@ It will help you to prevent MITM attacks"
echo
echo "[+] Cleaning iptables"
iptables -F
iptables -X
echo "[+] Dumping arp table"
cp /proc/net/arp .arp_backup.txt
echo "-----------------------------------------"
cat .arp_backup.txt
echo "-----------------------------------------"
cp .arp_backup.txt .IP_MAC.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
        cp /proc/net/arp .IP_MAC_compare.txt
        diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
        if [ -e .result.txt ];
        then
                if [ ! -s .result.txt ]
                then
                        echo "[+] Nothing detected"
                else
                        cp .IP_MAC_compare.txt .log.txt
                        sed -i '1iModification detected' .log.txt
                        echo "[+] Modification detected"

                        mv .IP_MAC_compare.txt .IP_MAC.txt
                        echo "----------------------------------------------------------------------------------"
                        cat .log.txt
                        echo "----------------------------------------------------------------------------------"
                        grep '<' .result.txt
                        grep '>' .result.txt
                        echo "----------------------------------------------------------------------------------"
                fi
        fi
        echo "[+] Wait 30 secs before next check"
        sleep 30
done

Ex094 · 02-22-2014, 04:14 PM

Nice concept, I'll try to come up with my own version of this program obviously not in Batch cuz it's not my thing Tongue

Good Work Though!

Ex094 · 02-22-2014, 04:14 PM

Nice concept, I'll try to come up with my own version of this program obviously not in Batch cuz it's not my thing Tongue

Good Work Though!

hunt3r972 · 02-22-2014, 04:22 PM

Post it too so !! Biggrin

hunt3r972 · 02-22-2014, 04:22 PM

Post it too so !! Biggrin

Ligeti · 02-22-2014, 10:40 PM

Hello

Looks interesting Smile

I tested it... but tere was a little tiny tiny error:

Quote:-----------------------------------------
[+] Starting monitoring (CTRL+C to stop)
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check

I think the reason is obvious, so I altered your code a little (sorry I did that without any previous permission)

Code:
cp .arp_backup.txt .IP_MAC.txt
chmon +w .IP_MAC_compare.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
       cat /proc/net/arp > .IP_MAC_compare.txt

       diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
       if [ -e .result.txt ];

You will have to change the permissions for the .log.txt file as well

Thanks

Ligeti · 02-22-2014, 10:40 PM

Hello

Looks interesting Smile

I tested it... but tere was a little tiny tiny error:

Quote:-----------------------------------------
[+] Starting monitoring (CTRL+C to stop)
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check

I think the reason is obvious, so I altered your code a little (sorry I did that without any previous permission)

Code:
cp .arp_backup.txt .IP_MAC.txt
chmon +w .IP_MAC_compare.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
       cat /proc/net/arp > .IP_MAC_compare.txt

       diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
       if [ -e .result.txt ];

You will have to change the permissions for the .log.txt file as well

Thanks

chmod · 02-22-2014, 10:58 PM

(02-22-2014, 10:40 PM)Ligeti Wrote: Hello

Looks interesting I tested it... but tere was a little tiny tiny error:

Quote:-----------------------------------------
[+] Starting monitoring (CTRL+C to stop)
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check

I think the reason is obvious, so I altered your code a little (sorry I did that without any previous permission)

Code:
25 cp .arp_backup.txt .IP_MAC.txt 26 chmon +w .IP_MAC_compare.txt 27 echo "[+] Starting monitoring (CTRL+C to stop)" 28 29 30 while [ 1 ]; 31 do 32 cat /proc/net/arp > .IP_MAC_compare.txt 33 34 diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt 35 if [ -e .result.txt ];

You will have to change the permissions for the .log.txt file as well

Thanks

Rather that change the permissions of files I think the intentions are to run this script with superuser/root permissions, nice workaround though

chmod · 02-22-2014, 10:58 PM

(02-22-2014, 10:40 PM)Ligeti Wrote: Hello

Looks interesting I tested it... but tere was a little tiny tiny error:

Quote:-----------------------------------------
[+] Starting monitoring (CTRL+C to stop)
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check

I think the reason is obvious, so I altered your code a little (sorry I did that without any previous permission)

Code:
25 cp .arp_backup.txt .IP_MAC.txt 26 chmon +w .IP_MAC_compare.txt 27 echo "[+] Starting monitoring (CTRL+C to stop)" 28 29 30 while [ 1 ]; 31 do 32 cat /proc/net/arp > .IP_MAC_compare.txt 33 34 diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt 35 if [ -e .result.txt ];

You will have to change the permissions for the .log.txt file as well

Thanks

Rather that change the permissions of files I think the intentions are to run this script with superuser/root permissions, nice workaround though

Keep an eye on your arp table
Author Message