Arp Spoof doesn't forward packets!

[Chaaru]

Hi,

I'm running Kali 2021.4 on my VirtualBox. I'm trying to arpspoof a MacBook which is in the same network!

The method I am using is:

Enable port forwarding:

echo 1 > /proc/sys/ipv4/ip_forward

Flushing IP tables:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete chain

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

arpspoof command: (arpspoof version 2.4)

arpspoof -i wlan0 -t <target> <router>
arpspoof -i wlan0 -t <router> <target>

I'm running both of these commands on separate windows. It issues a DoS, It is not forwarding packets to the victim, Mac. I tried all sorts of things. I'm making sure no Firewall is running. I flush my iptables before and after the arpspoof.

If you need my iptable listing, here it is:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

# iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT

I read many threads and tried all sorts of things, it doesn't seem to work. Kindly help me. If you need any further details, please let me know.

Thanks & Regards

[digininja]

If you are in virtualbox, are you running this on a USB wi-fi card?

[Chaaru]

1 minute ago, digininja said:

If you are in virtualbox, are you running this on a USB wi-fi card?

That's right!

[digininja]

I'd run packet sniffing on both hosts to see where the traffic is going. Is the victim recieving the ARP packets, is the attacker receiving the traffic from the victim?

[Chaaru]

16 minutes ago, digininja said:

I'd run packet sniffing on both hosts to see where the traffic is going. Is the victim recieving the ARP packets, is the attacker receiving the traffic from the victim?

I intercepted packets on both hosts. Victim, Mac is getting ARP packets. It is not sending back to the attacker! What could be the issue here?

Victim

Attacker

[digininja]

What does the ARP table on the victim say before and after it has received them?

If you want to test forwarding, when you get that far, you can set a static ARP entry on the victim to force traffic that direction.