ARP spoofing: MITM on the local network

On a LAN, ARP maps IPs to MAC addresses. There is no authentication: anyone can reply "the gateway's IP has my MAC".

The attack

The attacker sends forged ARP replies to the victim ("I am the gateway") and to the gateway ("I am the victim"). The ARP tables get poisoned and traffic flows through the attacker, now a man-in-the-middle.

arpspoof -i eth0 -t 192.168.1.10 192.168.1.1
# + ip_forward=1 to keep the connection alive

From there: sniffing, TLS downgrade (sslstrip), injection.

Defence

Dynamic ARP Inspection on switches, DHCP snooping, port security. Static ARP for critical hosts. At the application layer: TLS with HSTS makes MITM useless for interception, and certificate pinning for apps.