The previous lecture.
We get these responses from doing the ERP attack okay.
ARP spoofing attack.
And here we see that we are receiving this ERP packets okay.
Or ERP layers.
Here we have the OP that you see that it is a is at type.
And also you see the source uh w source.
And you see the IP you see the destination.
Okay.
So uh, the how can we create a program to detect this okay.
We need to create.
A program that check if these, um, IP address if this Mac address belongs to.
This one to this IP, which is if source.
Okay.
Actually we need to get the real Mac address of the computer and also the response Mac address.
So this is the response Mac address.
And also we need to get the real Mac address.
You know we had a function here called Get Mac.
By using its IP.
We get its Mac address.
So we will be using this get Mac to get the real Mac address of a computer.
And also we will be able to get the response Mac address from here.
Okay.
Very easy.
Now let me copy this function from this program that is ARP spoof program.
And I will be able to use it right here.
Okay.
Uh, let me put it up here.
Okay.
And this is one of the goodness of writing all your code in functions.
Now, I don't care if it is good or not, if how it is working.
Okay.
And I will just use it, and I will collapse this.
Space now?
Right in here.
Before, we were just showing the details inside this packet that we are.
We were receiving.
Now, I will get two things here.
Okay.
One of them is the real Mac address, which is equal to get Mac, get underscore Mac, which is a function.
You know that okay.
That we have it here by using its IP, it will give me the Mac address okay.
The real Mac address.
So how can we get the IP for this one.
So we need to use packet.
Okay.
Here we need to use Scapy dot arp because the response is an ARP response okay.
And also the source which is p is r c is r RC.
RC.
Okay.
And let me show you that.
Here we have P is RC.
This is the IP.
We will be giving this IP which is the color Linux IP address.
And it will give me this Mac address which is the real Mac address for this machine.
Okay.
Let me show you that if I use ifconfig.
Now you see that this is the real Mac address for this one.
And also this is the real IP address.
See that is here.
Now by giving this IP address it will give me the Mac address.
And that is called real Mac address here that I store it there.
And also we need to get the response Mac address.
So let's use response underscore Mac.
It is equal to.
Again we need to have packet okay.
And also escape dot AARP because it is an AARP response.
And here we need to use h w is r c y.
H w is r c because that is here h w is r c c right now.
This will give me the response Mac address.
Now we will be checking if this uh is W is or C which is the response Mac address okay.
If this is equal to real Mac address that is again this one okay.
If that is this both are equal.
So we are not under attack.
If this both is not equal.
So we were we are under attack okay.
So uh here I need to check that.
So how can I check that.
I can check that like this.
If this is a real Mac address is equal to response Mac address, we will be doing something here like.
We will print a text here.
Like you're not under attack.
But let's check the opposite of this one.
If real Mac address is not equal response okay, that is better.
If this booth is not equal, then we are under attack.
So I will say that you are under attack.
Okay.
So right now it will be working perfect.
But sometimes this get Mac will not be able to get the Mac address for a computer okay.
For this machine.
So for that it will give me an error.
And here we need to use and try an exception okay.
To it will say that index error.
Okay.
Index out of range.
Something like that.
So we can handle that very easily.
We use try here and in one tab.
And here use accept.
Add name of the error which is index error.
And here let's use pass keyword.
So it will be just passed.
And you see we use sniff function here.
Now let me save this okay.
And come back right here.
Let me clear this.
Okay.
Now if I execute this.
Because we are not under attack, it will do nothing okay at all.
Now let me come back to windows machine.
Try to again execute this one.
Okay.
And you see that it is telling me that you are under attack.
Okay.
Perfect.
It's packet that this is receiving.
Okay.
It will print me that you are under attack.
See?
Isn't that cool?
It is very beautiful.
Very cool.
Okay.
So.
And you see that we are having some kind of mistake here.
We don't need to put this inside this.
We need to put them outside of.
That curly brackets that will make it look more beautiful.
Something like this.
Okay.
Now, if I use Ctrl C again.
If I use like this.
If still we are under attack, so we will be receiving if we are not under attack, if that tag is finished.
So we don't have anything at all.
Okay, let's see here.
We are not under attack.
Okay.
You see, attack is 24 packets sent.
And here you see that we receive a get Mac, uh, error.
That means it could not get the Mac address for color Linux.
So it gives me something like that.
Again, if I execute that, once again, we see that attack.
Right now, you see your under attack.
We are receiving that.
And you see that it is doing the attack on the machine.
Okay.
So here you learn how to create an ARP spoof detector program that is working perfect.
Okay, so thanks for watching and I will see you in the next lecture, which is very, very cool.