ARP / DNS Concepts

# ===== 1) Rules of engagement (excerpt — signed before any run) =====
# Targets:      a test network you own (lab VLAN). Devices logged in advance.
# Off-limits:   any production VLAN, any device with real users on it.
# Window:       2026-06-18 09:00 - 17:00 AEST
# Goal:         validate that monitoring catches ARP poisoning and that TLS
#               + HSTS + cert pinning leave the attacker with nothing useful.
# Stop:         monitoring page, RoE end time, or > 30s sustained packet loss.

# ===== 2) Why this matters defensively =====
# ARP has no auth. ANYONE on the LAN can claim any IP.
# Test it to verify:
# - Switch port-security catches MAC spoofing
# - Dynamic ARP Inspection (DAI) blocks gratuitous ARP from the wrong port
# - IDS (Suricata, Zeek) alerts on rapid ARP changes
# - End-to-end TLS + HSTS + cert pinning render intercepted traffic useless

# ===== 3) Setup (your laptop on the lab network) =====
sudo apt install -y arpspoof dsniff tcpdump
# OR use ettercap / bettercap for a richer UI:
sudo apt install -y bettercap

# Enable forwarding so the attacker doesn't DROP intercepted traffic (just observes)
sudo sysctl -w net.ipv4.ip_forward=1

# Identify the gateway + target on the LAB network
ip neigh show
arp -a

# ===== 4) Run a controlled poisoning experiment =====
# Format: arpspoof -i <iface> -t <victim_ip> <gateway_ip>
sudo arpspoof -i eth0 -t 10.99.99.10 10.99.99.1     # tell the victim 'I am the gateway'
sudo arpspoof -i eth0 -t 10.99.99.1  10.99.99.10    # tell the gateway 'I am the victim'

# Now packets between them flow through you. Capture them to evaluate
# what is actually exposed.
sudo tcpdump -i eth0 -w session.pcap host 10.99.99.10 and not port 22

# ===== 5) What you should SEE (confirming the defences work) =====
# - TLS 1.2/1.3 handshake to api.lab.example.test, encrypted payload only
# - Browser refuses to fall back to HTTP for HSTS-preloaded hosts
# - Mobile apps with cert pinning REJECT the connection (the test MITM proxy
#   would fail the pin)
# - HTTP/2 to APIs over TLS — encrypted body
#
# What you should NOT see:
# - Plaintext credentials anywhere
# - Plaintext API tokens / session cookies
# - HTTP fallbacks on critical endpoints

# ===== 6) Detection — what monitoring SHOULD fire =====
# - Switch: 'arp inspection drop' counters increment
# - Suricata signature: 'ET POLICY ARP poisoning' / 'gratuitous ARP'
# - SIEM alert within 60 seconds with attacker MAC + port
# - Anomaly detection: MAC of the gateway IP changes within a minute

# ===== 7) Cleanup =====
# Stop arpspoof (Ctrl+C). It restores by sending the legitimate ARP entries.
sudo sysctl -w net.ipv4.ip_forward=0

# Verify victim's ARP table is back to normal:
ssh user@10.99.99.10 'arp -a'

# ===== 8) The DEFENCES you should leave running =====

# 8a) Switch port-security
# Cisco-style:
#   interface GigabitEthernet0/12
#     switchport port-security
#     switchport port-security maximum 1
#     switchport port-security violation restrict
#     switchport port-security mac-address sticky

# 8b) Dynamic ARP Inspection
# Cisco-style:
#   ip arp inspection vlan 10
#   ip dhcp snooping
#   ip dhcp snooping vlan 10

# 8c) 802.1X — auth every device that plugs in (RADIUS-backed)

# 8d) Static ARP for high-value servers
#   arp -s 10.99.99.1 aa:bb:cc:dd:ee:ff

# 8e) Network segmentation
# Public-facing services on a different VLAN from admin and lab hosts
# Microsegmentation in cloud / k8s with policies that deny by default

# 8f) End-to-end TLS + cert pinning
# An ARP attacker who succeeds in intercepting traffic sees TLS-encrypted
# bytes only. Without pinning, the attacker could MITM with their own CA
# installed on the victim; pinning closes that path on mobile.

# ===== 9) Reporting =====
cat <<'EOF'
## Finding: Dynamic ARP Inspection not enabled on lab VLAN 10
Severity:  Medium (LAN-level interception possible from any port)
Evidence:  arpspoof from port G0/12 succeeded; no DAI drop counters increased.
Fix:       Enable DAI on VLAN 10:
              ip arp inspection vlan 10
              ip dhcp snooping
              ip dhcp snooping vlan 10
           Verify with 'show ip arp inspection' after policy push.
Defence-in-depth recap:
- Switch DAI + port-security
- 802.1X for device-level auth
- TLS + HSTS + pinning means a successful intercept reveals nothing useful
EOF

# ===== 10) What NEVER to do =====
# - Run this on a network with real users
# - Sniff any traffic outside your authorised lab
# - Persist intercepted packets beyond minimum evidence
# - Demonstrate by capturing actual credentials, even on a lab system

# Concepts you should know to defend:
# ARP spoofing  — attacker poisons the local ARP table.
# DNS spoofing  — attacker answers DNS queries.
# Defence: 802.1x, DHCP snooping + DAI, DNSSEC, DNS over HTTPS.