Category Archives: (H) Hacking Tips

Emerging Threats ETOpen – Anti-malware IDS/IPS Ruleset

The ETOpen Ruleset is an excellent anti-malware IDS/IPS ruleset that enables users with cost constraints to significantly enhance their existing network-based malware detection. The ETOpen Ruleset is not a full coverage ruleset, and may not be sufficient for many regulated environments and should not be used as a standalone ruleset.

Emerging Threats ETOpen - Anti-malware IDS IPS Ruleset

The ET Open ruleset is open to any user or organization, as long as you follow some basic guidelines. The ET Open ruleset is available for download any time without login.

Requirements

To use this ruleset you needs an IDS such as Snort or Suricata.

For much deeper information on what you should do, how to tune your ruleset and more check here:

What Every IDS User Should Do

You http://doc.emergingthreats.net/bin/view/Main/WhatEveryIDSUserShouldDocan’t and definitely shouldn’t try and run every rule.

 

Rule Categories

  • Attack-Response Rules – These are designed to catch the results of a successful attack. Things like “id=root”, or error messages that indicate a compromise may have happened. Note: Trojan and virus post-infection activity is included generally in the VIRUS ruleset, not here.
  • BotCC Rules – These are autogenerated from several sources of known and confirmed active Botnet and other Command and Control hosts. Updated daily, primary data source is Shadowserver.org.
  • Compromised Rules – This is a list of known compromised hosts, confirmed and updated daily as well. This set varied from a hundred to several hunderd rules depending on the data sources. This is a compilation of several private but highly reliable data sources. Warming: Snort does not handle IP matches well load-wise. If your sensor is already pushed to the limits this set will add significant load. We recommend staying with just the BotCC rules in a high load case.
  • Current_Events Rules – These are rules that we don’t intend to keep in the ruleset for long, or that need to be tested before they are considered for inclusion. Most often these will be simple sigs for the Storm binary URL of the day, sigs to catch CLSID’s of newly found vulnerable apps where we don’t have any detail on the exploit, etc. Useful sigs, but not for the long term.
  • DOS Rules – Intended to catch inbound DOS activity, and outbound indications. Relatively self-explanatory.
  • DROP Rules – This is a daily updated list of the Spamhaus DROP (Don’t Route or Peer) list. Primarily known professional spammers. More info at http://www.spamhaus.org
  • DShield Rules – Daily updated list of the DShield top attackers list. Also very reliable. More indo at http://www.dshield.org
  • Exploit Rules – Rules to detect direct exploits. Generally if you’re looking for a windows exploit, Veritas, etc, they’ll be here. Things like SQL injection and the like, whie they are exploits, have their own category.
  • Game Rules – World of Warcraft, Starcraft, and other popular online games have sigs here. We don’t intend to label these things evil, just that they’re not appropriate for all environments.
  • Inappropriate Rules – Porn, Kiddy porn, sites you shouldn’t visit at work, etc. Warning: These are generally quite Regex heavy and thus high load and frequent false positives. Only run these if you’re really interested.
  • Malware Rules – My personal favorite. This set was originally intended to be just spyware. That’s enough to several rule categories really. The line between spyware and outright malicious bad stuff has blurred to much since we originally started this set. There is more than just spyware in here, but rest assured nothing in here is something you want running on your net or PC. There are URL hooks for known update schemed, User-Agent strings of known malware, and a load of other goodies. If you can only run one ruleset to jsutify your IDS infrastructure, this is it!
  • P2P Rules – Peer to Peer stuff. Bittorrent, Gnutella, Limewire, you name it. We’re not labeling these things Bad(tm), just not appropriate for all networks and environments.
  • Policy Rules – Rules for things that are often disallowed by company or organizational policy. Myspace, Ebay, that kind of thing.
  • RBN Rules – The Russian Business Network. These rules track the networks they’re known to own and regularly used. Updated whenever information changes.
  • Scan Rules – Things to detect reconnaissance and probing. Nessus, Nikto, portscanning, etc. Early warning stuff.
  • VOIP Rules – A new and emerging ruleset. Small at the moment, but we expect it to grow soon.
  • Web Rules – Some SQL Injection, web server overflows, vulnerable web apps, that kind of thing. Very important if you’re running web servers, and pretty reasonable load.
  • Web-SQL-Injection Rules – This is a large ruleset that intends to catch specific attacks on specific applications. There are some general SQL injection rules that work pretty well to catch most of what’s covered here. But these rules are much more specific to apps and web servers. Run this if you run a highly critical web farm, or are interested in having exact information about incoming web attacks.

The entire ruleset is available for download here:

https://rules.emergingthreats.net/

123456 Still The Most Common Password For 2016

So sadly, but also unsurprisingly ‘123456’ is still the most common password for 2016 (based on leaked password lists)

123456 Still The Most Common Password For 2015

Way back in 2006, it clocked in at number 5 in a rather UK centric look at passwords. Interestingly, back in 2006 a weaker version of the same password was number 1, I think 6 digit password requirements hadn’t become commonplace yet.

The top 10 most commonly used passwords for 2015:

1. 123456
2. password
3. 12345678
4. qwerty
5. 12345
6. 123456789
7. football
8. 1234
9. 1234567
10. baseball

And as you can see this year, 8 characters minimums must have become a thing with 12345678 clocking in at 6th place.

You’d think with all the massive, extremely messy, public hacks that have taken place – people would have wised up a little. But then I always forgot the number of stupid people is a constant, so the more people come on-line or use computers, the greater the absolute number of idiots there are.

The only thing I’m glad about is that football is more popular than baseball.

As for preventing this, use a password generator (preferably the one inside your password manager, because you are using a password manager right?), use separate passwords per site (easier with a password manager), don’t use predictable passwords (yourname, yourname1 etc for each different site).

Share ZIP, PDF, EXE, APK, RAR and Big Files: Whatsapp

This given whatsapp trick will help you to share zip, pdf, exe, apk, rar and big files from your whatsapp. As we all know whatsapp came with the limitation that you can only send audio, video and images with it. But with the help of this trick, You will be able to send or share ZIP, PDF, EXE, APK, RAR and even big files with your friends on whatsapp

 

Follow below steps to send big files on your whatsapp:

1. First of all install DropBox and CloudSend Application in your mobile

2. Open CloudSend, you will be prompted to link with Dropbox, Click Allow

3. Share the file on CloudSend which you want to share with your friends on whatsapp.

4. File be automatically uploaded to your DropBox server and link will be provided to that file

5. Copy the given link and share it to with your friends on WhatsApp. You friend will simply open that link and can able to download the file in their mobile

The above given whatsapp trick to send big files is very easy to use. If you have any doubts or find any difficulties to use this tricks then you can contact us or comment below. We will solve it as soon as possible.

.

Oracle Auditing Tools For Database Security

Oracle Auditing Tools is a tool kit that could be used to audit security within Oracle database servers.

OAT uses CREATE LIBRARY to be able to access the WinExec function in the kernel32.dll in Windows or the system call in libc on Un*x. Having access to this function makes it possible to execute anything on the server with the same security context as the user who started the Oracle Service. So basically all accounts with default passwords, or easy guessable password, having this privilege can do this.

Oracle Database Security

OAT has a builtin TFTP server for making file transfers easy. The Tools are Java based and were tested on both Windows and Linux. They should hopefully also run on any other Java platform.

We don’t write about many Oracle tools as they tend to be a bit ‘Enterprise’ but we did cover ODAT and way before that OAPScan:

– ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security
– OAPScan – Oracle Application Server Scanner

Contains

  • OraclePWGuess – A dictionary attack tool that can be used with user supplied dictionaries or with the builtin support for finding default accounts.
  • OracleQuery– A minimalistic command line based sql query tool.
  • OracleSamDump – Connects to the Oracle server and executes TFTP get, to fetch the pwdump2 binary. The server is then pwdump2:ed and the result is returned to the SAM folder of the TFTP server.
  • OracleSysExec – Can be run in interactive mode, letting the user specify commands to be executed by the server or in automatic mode. In automatic mode, netcat is tftpd over to the server and binds a shell to the tcp port 31337.
  • OracleTNSCtrl – is used to query the TNS listener for various information, like the Oracle lsnrctl utility. It is somewhat limited though. Use the help command to see commands curently implemented.

Requirements

– Java Runtime Environment
– Oracle JDBC Driver (classes111.zip or classes12.zip)

You can download OAT here:

Version 1.3.1 source oat-source-1.3.1.zip
Version 1.3.1 binary oat-binary-1.3.1.zip

How To Use Blocked Torrent Sites – AGAIN – (INDIA)

Shocking New For Torrent Users That Torrents Are Not Working In India

Well We Have Found Solutions For Them To Get Back In Pace

Step 1. If You Are Using Chrome Then Download Extension Named BETTERNET.

Step 2. Mostly Users Were Using Torrentz.eu . Well They Have Released New Version https://torrentz2.eu/

Step 3. After Installing BETTERNET Connect It and Start Opening Your Loving Torrent Site.

 

Peoples Who Were Using Kickass Torrent Their New Version IS http://kickass.cd/ 

Another Ways To Open Torrents Sites Is To Use Our Lovely TOR BROWSER

 

HOW TO JAILBREAK YOUR KINDLE PAPERWHITE 5.6.5

it’s finally possible to jailbreak the Kindle Paperwhite 5.6.5! Some awesome person on mobileread.com who goes by the handle ‘Branch Delay’ figured it out a few months ago, but waited until Amazon had a chance to update and patch the firmware against the hack before releasing it.

Amazon just released Kindle firmware version 5.7.2, so BD, true to their word, released instructions on how to jailbreak the Kindle Paperwhite (versions 2 and 3) running firmware 5.6.5.

Your Kindle should probably be in airplane mode at the moment, if you currently have firmware 5.6.5. If you just got your Kindle, put it in airplane mode immediately before the firmware updates itself automatically.

TO Jailbreak your Kindle:

  1. Download the jailbreak file. It should be called jb.zip.
  2. Unzip the jb.zip file and open the jb folder. Find the file inside called ‘jb’.
  3. Connect your Kindle to your computer and open it (just like a USB).
  4. Copy the jb file you found in step 2 onto your Kindle. Make sure not to put it inside a folder or anything.
  5. Eject your Kindle from your computer, turn off airplane mode and connect to Wi-Fi.
  6. Open the Kindle experimental browser and go to ‘kindlefere.com/jb/’.
  7. Follow the instructions there. They should involve clicking a couple of links on the page.
  8. When the jailbreak tells you to run ;fc-cache, open up the Kindle search function, type in ;fc-cache and then the return/enter button.
  9. When the jailbreak completes (you should see a message saying it was successful), turn airplane mode back on.
  10. Download the jailbreak bridge file. Unzip it and find the file called ‘Update_jailbreak_bridge_1.14.N_install.bin’.
  11. Connect to your computer again and put the Update_jailbreak_bridge_1.14.N_install.bin file onto your Kindle.
  12. Eject the Kindle from your computer, then go to [HOME] -> [MENU] > Settings -> [MENU] -> Update Your Kindle.

TO install KUAL (Kindle Unified Application Launcher):

  1. Connect your Kindle to the computer, download the KUAL-v2.6.zip file, unzip it and put the KUAL-KDK-2.0.azw2 file into the documents folder on the Kindle.
  2. Eject the Kindle and check for the KUAL application in the list of books.

TO install the KUAL MRpackage installer:

  1. Connect your Kindle to the computer, download the kual-mrinstaller-1.6.N.zip file, unzip it and put all the contents onto the Kindle. There should already be a folder called ‘extensions’ on your Kindle; make sure not to delete or overwrite anything already inside it.
  2. Eject the Kindle, run KUAL and check there is a menu item called ‘Helper’.

From here you can install the screensaver hack, and all sorts of other wonderful things (KOReader, anyone?)
The original instructions explain how to install the screensaver hack, so I suggest you follow them if that’s what you want.

If you have any comments or questions, please let me know below!

Top 10 Facebook profile hacking techniques!

There are many ways someone can hack Facebook Profile’s, and here are the 10 most usual:

1. Phishing

Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims “Email Address” and “Password” is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials.

2. Keylogging

Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim’s computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.

3. Stealer’s

Almost 80% percent people use stored passwords in their browser to access the Facebook. This is quite convenient, but can sometimes be extremely dangerous. Stealer’s are software’s specially designed to capture the saved passwords stored in the victims Internet browser.

4. Session Hijacking

Session Hijacking can be often very dangerous if you are accessing Facebook on a http (non secure) connection. In Session Hijacking attack, a hacker steals the victims browser cookie which is used to authenticate the user on a website, and use it to access the victims account. Session hijacking is widely used on LAN, and WiFi connections.

5. Sidejacking With Firesheep

Sidejacking attack went common in late 2010, however it’s still popular now a days. Firesheep is widely used to carry out sidejacking attacks. Firesheep only works when the attacker and victim is on the same WiFi network. A sidejacking attack is basically another name for http session hijacking, but it’s more targeted towards WiFi users.

6. Mobile Phone Hacking

Millions of Facebook users access Facebook through their mobile phones. In case the hacker can gain access to the victims mobile phone then he can probably gain access to his/her Facebook account. Their are a lots of Mobile Spying software’s used to monitor a Cellphone. The most popular Mobile Phone Spying software’s are: Mobile Spy, and Spy Phone Gold.

7. DNS Spoofing

If both the victim and attacker are on the same network, an attacker can use a DNS spoofing attack and change the original Facebook page to his own fake page and hence can get access to victims Facebook account.

8. USB Hacking

If an attacker has physical access to your computer, he could just insert a USB programmed with a function to automatically extract saved passwords in the Internet browser.

9. Man In the Middle Attacks

If the victim and attacker are on the same LAN and on a switch based network, a hacker can place himself between the client and the server, or he could act as a default gateway and hence capturing all the traffic in between.

10. Botnets

Botnets are not commonly used for hacking Facebook accounts, because of it’s high setup costs. They are used to carry more advanced attacks. A Botnet is basically a collection of compromised computer. The infection process is same as the key logging, however a Botnet gives you additional options for carrying out attacks with the compromised computer. Some of the most popular Botnets include Spyeye and Zeus.

Pixie Dust Attack WPS with Reaver

In this tutorial we are going to do a pixie dust attack using Reaver 1.5.2, Aircrack-NG and Pixiewps. Pixie Dust attack is an offline attack which exploits a WPS vulnerability. The tool, Pixiewps, is written in C and works with a modified version of Reaver. When a wireless router is vulnerable for this attack retrieving the passphrase can be done in seconds. A link to the list of pixie dust vulnerable routers is included at the bottom of this tutorial.

Pixie Dust Attack

Let’s put the wifi interface in monitoring mode using:
airmon-ng start wlan0

If necessary kill the processes Kali is complaining about:

Pixie dust attack Reaver

For anyone getting the following error in Kali Linux 2.0 Sana:

[X] ERROR: Failed to open ‘wlan0mon’ for capturing

Try the following as a solution:

1. Put the device in Monitor mode Airmon-ng start wlan0
2. A monitoring interface will be started on wlan0mon
3. Use iwconfig to check if the interface MODE is in managed mode, if so then change it to monitor instead of managed with the following commands:
ifconfig wlan0mon down
iwconfig wlan0mon mode monitor
ifconfig wlan0mon up
4. iwconfig check if the mode is monitoring mode now
5. airodump-ng wlan0mon

Start airodump-ng to get the BSSID, MAC address and channel of our target.

airodump-ng -i wlan0mon

Now pick the target and use the BSSID and the channel for Reaver:

Reaver -i wlan0mon -b [BSSID] -vv -S -c [AP channel]

We need the PKE, PKR, e-hash 1 & e-hash 2, E-nonce / R-nonce and the authkey from Reaver to use for pixiewps.

Pixie dust attack Reaver

Now start pixiewps with the following arguments:

Pixie dust attack Reaver

Components:
E-Hash1 is a hash in which we brute force the first half of the WPS PIN.
E-Hash2 is a hash in which we brute force the second half of the WPS PIN.
HMAC is a function that hashes all the data in parenthesis. The function is HMAC-SHA-256.
PSK1 is the first half of the router’s WPS PIN (10,000 possibilities)
PSK2 is the second half of the router’s WPS PIN (1,000 or 10,000 possibilities depending if we want to compute the checksum. We just do 10,000 because it makes no time difference and it’s just easier.)
PKE is the Public Key of the Enrollee (used to verify the legitimacy of a WPS exchange and prevent replays.)
PKR is the Public Key of the Registrar (used to verify the legitimacy of a WPS exchange and prevent replays.)

This router does not seem to be vulnerable to pixie dust attack.

Avoiding Reaver router lock-out with Pixiedust loop

When using the -P (Pixiedust loop) option, Reaver goes into a loop mode that breaks the WPS protocol by not using M4 message to avoid lockouts. This option can only be used for PixieHash collecting to use with pixiewps.

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

 

What is man in the middle attack? according to wikipedia:

In cryptography and computer security is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).

And what is ARP poisoning or ARP spoofing? according to wikipedia:

a technique whereby an attacker sends fake (“spoofed”) Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker’s MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

The man in the middle attack can happen because the attacker modified the ARP table(ARP spoofing) and change the ARP mapping to malicious attacker computer. Here I try to describe using picture(courtesy of: irongeek.com).

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

If we as a human absolutely we will know who is Alan and who is Brian by recognizing them from their face, but for our computer they depend on the ARP table network mapping (OSI layer 2 and layer 3).

<table border=”1″ cellpadding=”1″ cellspacing=”1″ style=”width: 500px;”>

Name IP Address MAC Address Alan 192.168.1.2 00-00-00-00-00-00-00-01 Brian 192.168.1.3 00-00-00-00-00-00-00-02 Cracker 192.168.1.88 00-00-00-00-00-00-00-03

table>

So if Alan want to connect to Brian, the computer will translate Brian IP address(192.168.1.3) to its MAC address 00-00-00-00-00-00-00-02. The correct way is should be like that, but because the attacker doing an ARP spoofing or ARP poisoning they will change the ARP mapping. If the network already poisoned, when Alan want to send packet to Brian, Alan will translate Brian(192.168.1.3) with MAC 00-00-00-00-00-00-00-03 and vice versa.

In this tutorial I will show you how the ARP spoofing can be happen and how to prevent it in your own computer so you will not be the victim.

The scenario for today tutorial I will use Windows 7 as victim and Kali Linux as attacker.

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN:

Before start, you can download the Static ARP changer tools to change the ARP routing automatically (128% virus free guaranteed)

Download Static ARP Changer

1. First I will show you my Windows 7 ARP table before poisoned by the attacker

arp -a

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

the red box in the picture above is victim router address and router MAC address is xx-xx-xx-5a-26-94. Victim IP address is 192.168.8.100.

Here is the attacker IP and MAC info:

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

2. When attacker doing ARP spoofing by using arpspoof and attacking the victim:

arpspoof -i eth0 -t 192.168.8.100 -r 192.168.8.8

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

Description:

-i eth0 –> attacker use the eth0 interface to perform the attack.

-t 192.168.8.100 –> attacker targeting the IP address 192.168.8.100.

-r 192.168.8.8 –> attacker will intercept the traffic between -t and -r where -r is the remote host or the router

3. When victim run the arp -a command again in his computer, the router MAC address was changed into the attacker computer.

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

that’s mean every transaction the victim made will go through attacker computer first and then go to the real router. We need to protect the ARP mapping table to make the attacker cannot do this to us.

4. We need to run this command in our Windows PC

arp -s 192.168.8.8 xx-xx-xx-5a-26-94

Description:

-s –> add a static ARP table

192.168.8.8 –> your router IP address

xx-xx-xx-5a-26-94 –> your router MAC address

Note: If you get this error “The ARP entry addition failed: Access is denied.

try to run this command to know your interface name:

netsh interface show interface

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

and then run this command to add static ARP:

netsh interface ip add neighbors “Wireless Network Connection” “192.168.8.8” “xx-xx-xx-5a-26-94”

now when we run again the arp -a command, our ARP table changed to static

4 Steps to Prevent Man in the Middle Attack ARP Poisoning in LAN

and when attacker run ARP spoofing again, our ARP table won’t changed because we already make it static :-)

Conclusions:

1. To prevent ARP spoofing and man in the middle attack in your local area network you need to add a static ARP.

2. This trick become troublesome if your router changed frequently, so if you use this prevention method you need to delete the old one and add the new one if it changed

3. You can download and use my Static ARP routing changer to change your ARP static routing automatically

Download Static ARP Changer

 

5 Ways to Protect Your Computer Against NetCut’s ARP Spoofing Attack

NetCut  is a Denial of Service type of tool that runs on Windows and is capable of cutting off a person’s internet connectivity when both are connected in the same local area network. Basically the ARP protocol is used to translate IP addresses to MAC addresses and NetCut exploits the weakness in the stateless ARP protocol due to the lack of authentication.

NetCut is very easy to use and can be used by anyone. Simply run the tool and it will detect all the connected devices in the same local area network. You can then select any target from the list followed by clicking the “Cut off” button, and within seconds the target will lose its internet connection. The affected target will have no idea what’s happened even if he/she has a firewall program installed.

netcut

Due to the way NetCut works, no firewall is able to prevent nor even detect the attack. In fact setting up static ARP entries like most other websites suggested will not protect you against NetCut attacks because NetCut directly attacks the gateway and not the user. Here is an investigation on how NetCut works and also the method to protect against the DoS attack. As we’ve mentioned earlier, none of the firewall software such as ZoneAlarm, Comodo, Outpost, GlassWire, SpyShelter, Privatefirewall, and etc is able to detect NetCut attack. However you can use XArp, which is a freeware tool that can detect ARP spoofing. By installing XArp and running it, you will be instantly notified when it detects an ARP spoofing attack including the attack from NetCut. The screenshot below shows a running XArp without attacks. Take note of the MAC address 00-21-5d-41-16-5a circled in red which is associated with the IP 192.168.2.8.

xarp no arp attacks

When NetCut starts attacking the IP 192.168.2.8 in an attempt to cut off the Internet connection, XArp immediately detects it and shows an alert popup with a few different messages. The most important message would be the one that reports that the MAC address for the IP 192.168.2.8 has been changed from 00-21-5d-41-16-5a to 03-27-75-49-18-73.

xarp alert

If you launch the XArp program from the notification tray icon, you will see that the MAC address for the IP 192.168.2.8 has been changed to 03-27-75-49-18-73 which is obviously wrong.

xarp arp attacks detected

This means that NetCut sends a spoofed packet to inform the gateway that the IP 192.168.2.8 is associated with an incorrect MAC address. Since the IP 192.168.2.8 isn’t mapped to the correct MAC address, the Internet connection breaks as well. Even a packet sniffer such as Wireshark confirms that spoofed packets are sent to the gateway with a wrong MAC address mapped to the IP 192.168.2.8.

wireshark netcut attack

When NetCut is actively attacking a target on the network, it will continuously send spoofed packets to the gateway so that there is no chance for the gateway to obtain the correct dynamic ARP table. Here we have 5 possible ways of protecting against NetCut attacks.

1. Static ARP Table in Router

Since NetCut sends spoofed packets to the router to mess with the dynamic ARP table, you can solve this problem by setting up a static ARP table in the router. Implementing static ARP routing will protect everyone that is connected to the network. However this is not really a solution for everyone because a lot of basic home based routers don’t support static ARP table and it doesn’t make sense to implement this on a public WiFi. Doing this on a large corporate network also requires a lot of manpower maintaining the IP to MAC address mappings.


2. NetCut

Ironically, the NetCut program that is used to cut off a person’s Internet connection has an option to protect against the attack. Simply make sure that the “Protect My Computer” checkbox is ticked and this will ensure that your IP address is mapped to the correct MAC address.

netcut protect my computer

Basically NetCut protects against its own attack by constantly sending packets to the gateway informing the router the correct mapping of the IP to MAC address. The router will be easily flooded with packets when NetCut is being used to attack and protect.

Download NetCut


3. NetCut Defender

If you’re not comfortable in having an attack program such as NetCut installed and running on your computer due to legal concerns, the author of NetCut also created a protection program called NetCut Defender. Basically it does the same thing as the “Protect My Computer” option found in NetCut except without the ability to cut off a person’s connection.

netcut defender

Nowhere on the official NetCut Defender’s website does it mention that it costs $9.99. You will start getting nagging popups to purchase the program after a couple of hours of usage. We cannot confirm the trial usage of NetCut Defender as we have not tested it extensively but what we can confirm is that it can surely keep you safe against NetCut attacks.

Download NetCut Defender


4. Outpost Firewall Pro

When NetCut is launched, it will automatically run an ARP broadcast sweep to detect all connected devices on the network. For example, if the computer running NetCut is connected to a network 192.168.2.1 gateway, it will perform an ARP sweep from 192.168.2.1 to 192.168.2.255. Unlike ICMP ping that can be easily blocked, ARP requests are normally responded and not blocked. When a device responds to the ARP request made by NetCut, the device is added to the list that can be attacked. Outpost Firewall Pro has an option to block ARP scan.

outpost attack detection report

Go to Settings > Advanced settings > Attack Detection > click the Customize button > select “Block host when it enumerates other computers on LAN” and click OK to close the Attack Detection window followed by clicking OK to save the Settings.

block host when it enumerates other computers on lan

Enabling this option will prevent your computer from being listed in NetCut. The attacker will most likely attack another computer instead of yours. Outpost Firewall Pro is a shareware that cost $29.95 for a 1 year subscription on a single license.

Download Outpost Firewall Pro


5. ESET Smart Security

ESET Smart Security is one of the few internet security applications that can be configured to disallow responses to an ARP request. By doing this, NetCut won’t be able to find your computer during an ARP sweep when the program is launched or when the “Refresh Net” button is clicked. To configure ESET Smart Security to block an ARP scan, open the program, go to Setup and click onNetwork. Click Advanced Personal firewall setup that is located at the bottom.

eset advanced personal firewall setup

Expand Network > Personal firewall and select IDS and advanced options. Uncheck “Allow response to ARP requests from outside the Trusted zone” and click OK.

eset allow response to arp request from outside the trusted zone

For this setting to take effect, you need to select the “Public network” as the desired protection mode of your computer in the network. Normally this option would show up when you are connected to a new network. To check the settings, at the Network protection setup, click on “Change the protection mode of your computer in the network“.

Select Public network option and click OK.

eset computer protection mode

The NetCut program won’t be able to find your computer on the network, thus keeping you safe from being attacked.
Read More:https://www.raymond.cc/blog/protect-your-computer-against-arp-poison-attack-netcut/