+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: [Cryptix] ArpSploit - Exploit The Local Network (/showthread.php?tid=5566910)
[Cryptix] ArpSploit - Exploit The Local Network - MR - X - Mar 5, 2017
ArpSploit - Exploit Local Network
ArpSploit is a program I created that allows you to easily with a single button click exploit your network. It works by automaticly obtaining the gateway IP of your current connection. It then does a quick scan to detect other devices alive on the network. It then automaticly continues to arp posion the network telling all devices on the network to direct traffic to your device.
As the arp spoof attack starts the program is set to capture login data/messenger data & download data. And stores all this into a pcap file. The program is also set to automaticly dump the pcap data into readable text which can be switched on or off at anytime.
You can also save the pcap file of your capture attack and then analyze with other software if you wish to have more than just readable text, somthing like networkminer for example.
https://sourceforge.net/projects/networkminer/
![[Image: imageedit_2_9792023293.png]](https://image.ibb.co/hAcHBF/imageedit_2_9792023293.png)
I do not advice to use this program in wine - If on linux use VM as wine cant support the built in winsock data.
AV Scan -
https://www.virustotal.com/en/file/354bc00cb21e9e9f5a5a34bbe1e1fe273e10f15ccefaf87a271c5d92559b6e08/analysis/
Download -
http://cryptixchat.loseyourip.com/arpsploit/ArpSploit.zip
* - Jin Goddo - Mar 5, 2017
Care to explain the file that it drops?
https://www.virustotal.com/en/file/5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118/analysis/
* - MR - X - Mar 5, 2017
(Mar 5, 2017 06:00 AM)Jin Goddo Wrote: Care to explain the file that it drops?
https://www.virustotal.com/en/file/5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118/analysis/
The file this program uses to arp spoof and catch packets on the network with is intercepter-ng
And mostly AV just shows false positives for intercepter-ng anyways because it was packed with armadillo PE packer.
![[Image: intercepter.jpg]](https://image.ibb.co/myxsBF/intercepter.jpg)
* - wellah - Mar 5, 2017
This looks extremely nice, good job OP!
* - Axion - Mar 5, 2017
What is Nirsoft password recovery doing there?
* - MR - X - Mar 5, 2017
(Mar 5, 2017 07:06 AM)Axion Wrote: What is Nirsoft password recovery doing there?
Go to intercepter-ng website and scan there CE builds
http://sniff.su/
My program uses the exact build from intercepter-ng website,
pretty sure its a false positive anyways as I didnt see intercepter-ng sending any remote packets. It might just use a header that nirsoft password extract uses to read or decrypt certain passwords captured in the packets as plain text when using stdout.