Hello, aspiring ethical hackers. In our previous blogpost on data link layer attacks, you learnt what is a hub, What is a switch, how they both work, what is a MAC address, what is a CAM table and different types of LAN attacks etc. In this blogpost, you will learn about one of the LAN attacks, MAC Spoofing.
What is MAC spoofing?
MAC Spoofing is a technique in which a factory assigned Media Access Control (MAC) address of a network interface is changed or altered. As communication between devices in a single LAN takes place using the MAC address of the device, changing the MAC address to that of another device will make all the traffic belonging to that device visible to the attacker.
For example, let’s say there are two devices A and B. An attacker changed the MAC address of the device “A” to that of “B”. Then all the traffic belonging to “B” will be coming to “A” and the attacker can sniff this traffic. MAC spoofing attack can be performed after gaining access on the target network.
How can MAC address be changed?
MAC address of a network interface card can be changed either manually or using a tool. Let’s see how to change the MAC address of a Linux machine manually. For this, I will be using Kali Linux. The first method we can use to change MAC address in a Linux machine is the “ifconfig” command. Ifconfig is a command line tool in UNIX operating systems that is used to configure network interfaces.
To change the MAC address of the network interface, we need to first disable the network interface. This can be done with “ifconfig” using the command below.
sudo ifconfig <network interface> down
Then we can change the MAC address using the command shown below.
sudo ifconfig <network interface> hw ether <new MAC address>
For example, let’s assign a MAC address ee:12:ee:ff:45:54 to the interface eth0.
Then all we have to do is enable the network interface as shown below.
Let’ see use the ifconfig command again to see if the MAC address has changed.
It has changed. There is another way in which we can change the MAC address using ip command of Linux too. Even for this, you have to disable the network interface. This can be done with “ip” as shown below.
To change the MAC address with ip utility, the command is given below.
sudo ip link set <network interface> address <new MAC address>
For example,
Then all we have to do is enable the network interface as shown below.
We can also use tools to change MAC addresses. one such tool is mac changer. See the complete guide to change MAC addresses with macchanger tool.
Learn how to change the MAC address of a Windows machine manually here.
Follow Us
