Keep an eye on your arp table - Printable Version

Keep an eye on your arp table - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: Keep an eye on your arp table (/Thread-Keep-an-eye-on-your-arp-table)

Pages: 1 2

Keep an eye on your arp table - hunt3r972 - 02-22-2014

This script will help you to see if something is going wrong in your arp table. It will tell you any modification into this one:

Code:
#!/bin/bash

echo
echo '          _____  _____     _____'
echo '    /\   |  __ \|  __ \   / ____|'
echo '   /  \  | |__) | |__) | | (___  _   _ _ ____   _____ _   _' 
echo '  / /\ \ |  _  /|  ___/   \___ \| | | |  __\ \ / / _ \ | | |'
echo ' / ____ \| | \ \| |       ____) | |_| | |   \ V /  __/ |_| |'
echo '/_/    \_\_|  \_\_|      |_____/ \__,_|_|    \_/ \___|\__, |'
echo '                                                       __/ |'
echo '                                                      |___/' 
echo
echo "By 9H4C7K3R2 - v1.0"
echo "@ Print the arp table and show the modification"
echo "@ It will help you to prevent MITM attacks"
echo
echo "[+] Cleaning iptables"
iptables -F
iptables -X
echo "[+] Dumping arp table"
cp /proc/net/arp .arp_backup.txt
echo "-----------------------------------------"
cat .arp_backup.txt
echo "-----------------------------------------"
cp .arp_backup.txt .IP_MAC.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
        cp /proc/net/arp .IP_MAC_compare.txt
        diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
        if [ -e .result.txt ];
        then
                if [ ! -s .result.txt ]
                then
                        echo "[+] Nothing detected"
                else
                        cp .IP_MAC_compare.txt .log.txt
                        sed -i '1iModification detected' .log.txt
                        echo "[+] Modification detected"

                        mv .IP_MAC_compare.txt .IP_MAC.txt
                        echo "----------------------------------------------------------------------------------"
                        cat .log.txt
                        echo "----------------------------------------------------------------------------------"
                        grep '<' .result.txt
                        grep '>' .result.txt
                        echo "----------------------------------------------------------------------------------"
                fi
        fi
        echo "[+] Wait 30 secs before next check"
        sleep 30
done

Keep an eye on your arp table - hunt3r972 - 02-22-2014

This script will help you to see if something is going wrong in your arp table. It will tell you any modification into this one:

Code:
#!/bin/bash

echo
echo '          _____  _____     _____'
echo '    /\   |  __ \|  __ \   / ____|'
echo '   /  \  | |__) | |__) | | (___  _   _ _ ____   _____ _   _' 
echo '  / /\ \ |  _  /|  ___/   \___ \| | | |  __\ \ / / _ \ | | |'
echo ' / ____ \| | \ \| |       ____) | |_| | |   \ V /  __/ |_| |'
echo '/_/    \_\_|  \_\_|      |_____/ \__,_|_|    \_/ \___|\__, |'
echo '                                                       __/ |'
echo '                                                      |___/' 
echo
echo "By 9H4C7K3R2 - v1.0"
echo "@ Print the arp table and show the modification"
echo "@ It will help you to prevent MITM attacks"
echo
echo "[+] Cleaning iptables"
iptables -F
iptables -X
echo "[+] Dumping arp table"
cp /proc/net/arp .arp_backup.txt
echo "-----------------------------------------"
cat .arp_backup.txt
echo "-----------------------------------------"
cp .arp_backup.txt .IP_MAC.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
        cp /proc/net/arp .IP_MAC_compare.txt
        diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
        if [ -e .result.txt ];
        then
                if [ ! -s .result.txt ]
                then
                        echo "[+] Nothing detected"
                else
                        cp .IP_MAC_compare.txt .log.txt
                        sed -i '1iModification detected' .log.txt
                        echo "[+] Modification detected"

                        mv .IP_MAC_compare.txt .IP_MAC.txt
                        echo "----------------------------------------------------------------------------------"
                        cat .log.txt
                        echo "----------------------------------------------------------------------------------"
                        grep '<' .result.txt
                        grep '>' .result.txt
                        echo "----------------------------------------------------------------------------------"
                fi
        fi
        echo "[+] Wait 30 secs before next check"
        sleep 30
done

RE: Keep an eye on your arp table - Ex094 - 02-22-2014

Nice concept, I'll try to come up with my own version of this program obviously not in Batch cuz it's not my thing Tongue

Good Work Though!

RE: Keep an eye on your arp table - Ex094 - 02-22-2014

Nice concept, I'll try to come up with my own version of this program obviously not in Batch cuz it's not my thing Tongue

Good Work Though!

RE: Keep an eye on your arp table - hunt3r972 - 02-22-2014

Post it too so !! Biggrin

RE: Keep an eye on your arp table - Ligeti - 02-22-2014

Hello

Looks interesting Smile

I tested it... but tere was a little tiny tiny error:

Quote:-----------------------------------------
[+] Starting monitoring (CTRL+C to stop)
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check
cp: cannot create regular file `.IP_MAC_compare.txt': Permission denied
[+] Nothing detected
[+] Wait 30 secs before next check

I think the reason is obvious, so I altered your code a little (sorry I did that without any previous permission)

Code:
cp .arp_backup.txt .IP_MAC.txt
chmon +w .IP_MAC_compare.txt
echo "[+] Starting monitoring (CTRL+C to stop)"


while [ 1 ];
do
       cat /proc/net/arp > .IP_MAC_compare.txt

       diff .IP_MAC.txt .IP_MAC_compare.txt > .result.txt
       if [ -e .result.txt ];

You will have to change the permissions for the .log.txt file as well

Thanks