ARP攻击之Kali Linux局域网断网攻击
特别声明：
我们学习研究网络安全技术的目的应是为了维护网络世界的安全，保护自己和他人的私有信息不被非法窃取和传播。请您遵守您所在地的法律，请勿利用本文所介绍的相关技术做背离道德或者违反法律的事情。
Special statement:
The purpose of our study of cyber security technology should be to maintain the security of the cyber world and protect the private information of ourselves and others from being illegally stolen and disseminated. Please comply with your local laws. Do not take advantage of the relevant technology introduced in this article to do anything that deviates from morality or against the law.
在这里，作为攻击者的计算机使用的是安装在VMware Workstation中的Kali Linux，我们需要在虚拟机的设置中将Kali的联网方式改成“桥接模式”，并且不要勾选“复制物理网络连接状态”。
获取目标主机IP
在这里，我们使用Ettercap对内网进行扫描以获取目标主机IP和网关的信息。输入命令:
ettercap -G #打开Ettercap的GUI界面依次点击“Sniff(嗅探) -> Unified sniffing(统一嗅探)”，之后弹出如下界面让选择进行扫描的网络接口（Network interface）这里我们使用默认的eth0端口。点击“OK”。之后依次点击“Hosts(主机) -> Scan for hosts(扫描主机)”。
这时会出现一个进度条，等待进度条结束，依次点击“Hosts -> Hosts list(主机列表)”即可显示本机所在局域网中除本机之外，当前已连接至网络的设备的IP地址和MAC地址。
对局域网内的目标主机实施断网攻击
我们使用Kali Linux中的Arpspoof进行ARP攻击。
在实施断网攻击前，我们先测试一下目标主机192.168.50.130是不是能上网，输入命令：
ping www.baidu.com发现可以Ping通，说明目标主机在攻击开始之前是可以上网的。
在我们的攻击机上，即Kali中，输入命令：
arpspoof [-i interface] [-c own|host|both] [-t target] [-r] host
e.g:
arpspoof -i eth0 -t 192.168.50.130 192.168.50.1回车就开始对目标主机进行断网攻击了，此时我们在目标主机上执行命令：
ping www.baidu.com就会返回一个错误提示：“Ping请求找不到主机www.baidu.com”。
通过上述命令产生的Arpspoof的攻击进程不会自动停止，除非当前攻击链路被中断，如攻击机关机或者断开与当前局域网的连接，或目标机关机或者断开与当前局域网的连接或者更改了其在当前局域网内的IP地址。我们可以在Arpspoof进程所在终端上使用“Ctrl+Z”手动关闭Arpspoof的攻击进程。
关闭Arpspoof的攻击进程后，之前被攻击的目标主机一般会在几秒钟的时间内自动恢复正常的网络连接。
Ettercap0.8.2的帮助信息（命令ettercap -help）：
ettercap 0.8.2 copyright 2001-2015 Ettercap Development Team
Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]
TARGET is in the format MAC/IP/IPv6/PORTs (see the man for further detail)
Sniffing and Attack options:
-M, --mitm <METHOD:ARGS> perform a mitm attack
-o, --only-mitm don't sniff, only perform the mitm attack
-b, --broadcast sniff packets destined to broadcast
-B, --bridge <IFACE> use bridged sniff (needs 2 ifaces)
-p, --nopromisc do not put the iface in promisc mode
-S, --nosslmitm do not forge SSL certificates
-u, --unoffensive do not forward packets
-r, --read <file> read data from pcapfile <file>
-f, --pcapfilter <string> set the pcap filter <string>
-R, --reversed use reversed TARGET matching
-t, --proto <proto> sniff only this proto (default is all)
--certificate <file> certificate file to use for SSL MiTM
--private-key <file> private key file to use for SSL MiTM
User Interface Type:
-T, --text use text only GUI
-q, --quiet do not display packet contents
-s, --script <CMD> issue these commands to the GUI
-C, --curses use curses GUI
-D, --daemon daemonize ettercap (no GUI)
-G, --gtk use GTK+ GUI
Logging options:
-w, --write <file> write sniffed data to pcapfile <file>
-L, --log <logfile> log all the traffic to this <logfile>
-l, --log-info <logfile> log only passive infos to this <logfile>
-m, --log-msg <logfile> log all the messages to this <logfile>
-c, --compress use gzip compression on log files
Visualization options:
-d, --dns resolves ip addresses into hostnames
-V, --visual <format> set the visualization format
-e, --regex <regex> visualize only packets matching this regex
-E, --ext-headers print extended header for every pck
-Q, --superquiet do not display user and password
LUA options:
--lua-script <script1>,[<script2>,...] comma-separted list of LUA scripts
--lua-args n1=v1,[n2=v2,...] comma-separated arguments to LUA script(s)
General options:
-i, --iface <iface> use this network interface
-I, --liface show all the network interfaces
-Y, --secondary <ifaces> list of secondary network interfaces
-n, --netmask <netmask> force this <netmask> on iface
-A, --address <address> force this local <address> on iface
-P, --plugin <plugin> launch this <plugin>
-F, --filter <file> load the filter <file> (content filter)
-z, --silent do not perform the initial ARP scan
-6, --ip6scan send ICMPv6 probes to discover IPv6 nodes on the link
-j, --load-hosts <file> load the hosts list from <file>
-k, --save-hosts <file> save the hosts list to <file>
-W, --wifi-key <wkey> use this key to decrypt wifi packets (wep or wpa)
-a, --config <config> use the alterative config file <config>
Standard options:
-v, --version prints the version and exit
-h, --help this help screen
