View Full Version : Spoofa - an Arpspoof replacement

2013-08-15, 11:52

Arpspoof is broken in Kali, and based on the bugtracker it doesn't look
like it will be fixed anytime soon. And much as I appreciate all the
hard work going into Ettercap, I find it slightly unstable at
times. So I still have a need for arpspoof, and have written a new version
in Ruby.

I'm keen to fix bugs, so give it a go and let me know if there are any

apt-get install ruby-dev
gem install pcaprub
gem install packetfu

cd /path/to/your_clones
git clone https://github.com/SilverFoxx/Spoofa
cd Spoofa
ruby spoofa -h

From the README.md:

# Spoofa

A Ruby replacement for Arpspoof

### Install Requirements

```gem install pcaprub```
```gem install packetfu```

### Usage

#### Interactive mode

Start without any arguments: ```ruby spoofa```

Runs a quick script to set the variables. Will offer sane defaults for the various options.

#### Command line mode

```ruby spoofa [-hmpv] [-t target(s)] [-g gateway] -i interface```


*-i interface*


*-h* Help

[*-m* Smart ARPing; NOT YET AVAILABLE. Attempts to monitor ARP requests from the target(s), and only reply as necessary. *May* avoid IDS/ARPwatch etc.]

*-p* Uses parallel/multi-threaded scanning. Very slow without it; but possibly unstable on some systems. Best run with "-v".

*-v* Run verbosely

*-t targets(s)* One or more targets separated by comma (no whitespace), and/or hyphened range(s). E.g. "-t,". If omitted, the entire subnet will be targeted. Without [-g], one-way spoofing is performed, i.e. packets *from* the target are intercepted."

*-g gateway* A second target, usually the gateway. Performs two-way spoofing, i.e. intercepts packets both to *and* from the target.

#### Examples

```ruby spoofa -t -i eth0``` One-way spoofing of to

```ruby spoofa -t, -g -i wlan1``` Two-way spoofing of and 10-20, and the gateway (

```ruby spoofa -vp -i wlan3``` One-way spoofing of all live hosts, verbosely, with multi-threading.

```ruby spoofa``` Starts in interactive mode, and prompts for variables.

### Troubleshooting

Tested on Kali Linux only.

Check gems are installed: ```gem list```

If errors installing gems, first try: ```apt-get install ruby-dev libpcap0.8-dev```

Run packetfu's tests:

```cd /var/lib/gems/1.9.1/gems/packetfu-1.1.8/test/ && ruby all_tests.rb```

Play with packetfu's excellent irb (check is executable first):

```cd /var/lib/gems/1.9.1/gems/packetfu-1.1.8/examples && irb -r ./packetfu-shell.rb```

Ensure you are connected to the network before running the script.

Multi-threading is used to speed up the scanning (live host detection). The settings are conservative (runs on 2011 MBA, VMWare Fusion, 800MB RAM assigned). If the scanning hangs, try without "-p".

Best to use a USB wireless card if running in a VM, due to the unpredictable way the VM handles address assignment.

### Author

VulpiArgenti (SilverFoxx) (C) 2013

### Licence

GPL. See LICENSE for licensing details.

2013-09-16, 19:06
by the way if you get this error with gem install pcaprub:

ERROR: Error installing pcaprub:
ERROR: Failed to build gem native extension.

then install this lib:

apt-get install libpcap-dev


2013-09-19, 20:07
hey, i get the same error while installing pcaprub. but i've libpcap-dev already installed.

root@b0x:~# gem install pcaprub
Building native extensions. This could take a while...
ERROR: Error installing pcaprub:
ERROR: Failed to build gem native extension.

/usr/bin/ruby1.9.1 extconf.rb
/usr/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require': cannot load such file -- mkmf (LoadError)
from /usr/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from extconf.rb:1:in `<main>'

Gem files will remain installed in /var/lib/gems/1.9.1/gems/pcaprub-0.11.3 for inspection.
Results logged to /var/lib/gems/1.9.1/gems/pcaprub-0.11.3/ext/pcaprub/gem_make.out

can anyone help me out on this?

2013-09-24, 12:47
Have you tried (from the README):

apt-get install ruby-dev

2013-09-24, 12:50
Lots of improvements recently. I think it's ready for prime-time (let me know if you disagree).