Experiment 2

Chinese People's Public Security University

Chinese people’ public security university

Network Warfare Technology

experimental report

The second experiment

Network sniffing and spoofing

student name	Wang Xuan
grade	201621450007
District Team	Net 6 17
mentor	Your opinion

Institute of Technology and Information Network Security

2016 Nian 11 Yue 7 Ri

Master experimental task

2016-2017 school year, Di Yi semester

First, the purpose of the experiment

1. Deepen and digest this course lectures, review what they have learned through the Internet search techniques, methods and techniques;

2. Become familiar with commonly used network sniffer way to master the common packet capture and filtering techniques to use software can analyze network basic behavior of a given data packet; master the basic principles of ARP spoofing, DNS-based attacks and ARP spoofing;

3. The purpose of the consolidation of curriculum knowledge and practical application.

Second, the experimental requirements

1. Carefully read the contents of each experiment, we need to capture the title, to be clear screenshots and annotate screenshots and descriptions.

2. Documentation Requirements clear structure, graphic expression accurate labeling specifications. Reasoning was objective, reasonable and logical.

3. Software tools can be used office2003 or 2007, CAIN, Wireshark and so on.

4. After the experiment, to retain electronic documents.

Third, the experimental procedures

1. ready

Experimental preparation well in advance, should learn more about the purpose of the experiment, test requirements and test content before the experiment, familiar with the software tools and ready with a good experiment, in accordance with the requirements of experimental content and experimental content ready ahead of time.

2. lab environment

Describes the hardware and software environment used in the experiment (including a variety of software tools);

Office2003 boot and start the software or 2007, browser, Wireshark, CAIN.

Tools Download:
CAIN https://pan.baidu.com/s/19qDb7xbj1L_2QnoPm71KzA

Wireshark link: https: //pan.baidu.com/s/1BeXghjVV9Mll_cAmeMCTPg Password: mbpv

Mini FTP https://pan.baidu.com/s/16ms4hXVOmMHhDEe3WraRHQ

NetworkMiner https://pan.baidu.com/s/14e3VluLPjWFKxqNhdpYO9Q

3. experiment procedure

1) Start the system and start-up tool environment.

2) realization of experimental content using software tools.

4. experimental report

Write lab reports in accordance with the standard requirements of the test report format. The document prepared in accordance with the format template embedded test report document, the document written in accordance with the provisions of the written format, the form must be said that the graphics have a table Illustrated.

The first part of the ARP spoofing

1. a set of two students, the following experiment was conducted topology environment shown in FIG.

2. longitudinal spoofing attacks by Arp-a command to verify successful deception (screenshot attached)

3. The process of deception, the host A is turned Wireshark capture, analyze the characteristics of the data packet spoofing attacks APR process. (Screenshot attached)

4. The process of deception, open Wireshark capture performed in the host C, analysis of the FTP protocol login procedure (flowchart attached)

5. After the completion of deception, the host C is successfully acquired user name and password FTP (screenshot attached)

ARP spoofing attacks procedure shows (for reference only)

Query the status of the victim host before being deceived

ARP spoofing machine before 192.168.31.235 normal cache table (experiment IP and this IP may not the same),

ARP spoofing 192.168.31.236 machine before normal cache table (IP experiments possible and this is not the same IP)

2, at 192.168.1.50 (IP experiments and this may be different) No. cain running machine, select the sniffer card (single card, you can default)

3, click on the card icon in the toolbar, then select sniffer page, and then select the lower left corner of the hosts, right click and choose "scan MAC address", active host IP scan LAN and MAC address

In addition to the gateway, to scan the target 192.168.31.135 and 192.168.31.136

3、选中ARP页-》点下列表栏空白处，大加号变为可选-》点大加号，在弹出的窗口中选择要嗅探的目标主机（注意这里的选择和单击欺骗嗅探不一样，左面直接点网关，其它机器自动出现在右侧列表中，这时需要按住ctrl键在右侧选择你需要嗅探的主机，如图所示）

点oK按钮，回到软件主窗体，如图所示（这是欺骗两台机器）