Spoofing is a category of network attacks
that occurs when an attacker masquerades as another person
by falsifying their identity.
Just like a person in real life might use a mask
to cover their face and hide their true identity,
spoofing is the electronic equivalent.
Really, anything that identifies a user
or system can be spoofed.
But in this lesson, we're going to focus on MAC spoofing.
Now, before we dive into MAC spoofing though,
let's quickly review what a MAC address actually is.
Now, a MAC address
or Media Access Control Address is a means
for identifying a device physically
and allowing it to operate on a logical topology.
MAC addresses are used in switch-based networks
to communicate using frames on a Layer 2 network.
While IP addresses are used by routers
to help identify networks
and clients on different subnets or networks,
MAC addresses are used
to identify devices on the same subnet or same network.
MAC address is going to be assigned
to each device based on its network card.
Each network card manufacturer assigns
a unique 48-bit physical address
to every network interface card
that they produce.
This 48-bit physical address is written
as a 12-digit sequence of hexadecimal numbers that are used
to represent the interface's MAC address.
Each hexadecimal character is going to represent four bits.
The first 24 bits, which is the first six hex digits,
are going to be used to identify the particular vendor
who made that card.
The second 24 bits of the address,
or the second six hex digits, are going to be used
to represent the exact machine that it belongs to.
When frames are being sent around the network,
they use the full 48 bits
to uniquely identify the network interface card
that's being used by a given workstation.
Now, Layer 2 devices like switches and bridges
use MAC addresses to associate which device is connected
to which physical port on a given switch or bridge.
When a device communicates using Layer 2,
the switch is going to identify which physical port it's on
and its MAC address.
And then it adds that information into
the switch's cam table.
This allows a switch to only send data to the physical ports
that are associated with the destination MAC address
of any given frame.
This will be used to speed up the network
and it also increases the security of the data,
because only the device that the frame is addressed
to should be able to see that data.
Now, MAC addresses are also used in security though
through the use of MAC filtering.
For example, in wireless networks, it's quite common
to use an allowlist of the MAC addresses that are allowed
to connect to a given access point.
Or alternatively, you can use a blocklist
that are going to say which
devices are not allowed to connect.
This is a basic form of network access control or NAC.
To overcome this as a penetration tester,
you can simply change your MAC address from the one assigned
by the manufacturer to another value.
For example, if the network uses an allowlist containing
all the MAC addresses that are authorized to connect
to the network, you can change your MAC address to one
that is in the allowlist.
MAC spoofing is actually really easy to do.
Even though MAC addresses are burned into a interface card,
most operating systems do allow you to overwrite this value
inside of the operating system.
For example, I use a MacBook
and I can change my MAC address of my wireless adapter
in that MacBook using a single command inside
of the terminal.
I simply enter: sudo ifconfig en0 ether
and the MAC address that I want to use.
Now, all of a sudden, my MAC address has been changed
to the MAC address that I specified in that command.
Now, if I reboot my laptop though,
it's going to reset my MAC address back to the one
that was burned into my wireless adapter
by the manufacturer.
This allows me to change my MAC temporarily during
an engagement if I need to by using this command.
Now in Kali Linux,
you can also use a command line tool called MAC changer
to change your MAC address.
If you want to learn more about MAC changer,
simply type in: `macchanger -h` at the Kali prompt
to bring up the help file,
and this will show you all the options
that are available in this tool.
To change the MAC address of your Kali machine,
you can simply enter: macchanger -m, the MAC address,
and then the interface.
This will assign the MAC address that you specify
to the network interface card you listed in the command.
This is really useful if you need
to impersonate another device in order
to bypass an allowlist inside of the network.
If you're trying to avoid a blocklist
in the network though,
you can instead choose any random MAC address
and have it assigned to your network interface card
instead of specifying the MAC address like we did
with the -M option.
To assign a random MAC address
to your network interface card,
simply enter: macchanger -r in the interface.
For example, back in the old days, if you went
to a coffee shop or an airport
and you tried to use their wireless network,
they might give you 15 minutes of free Wi-Fi.
Now, after the 15 minutes,
they would automatically add your MAC address
to their blocklist and kick you off of the network
until midnight when the blocklist was reset
and cleared that everyone can start using the network again.
Now, if you wanted more time,
you could simply assign yourself a new random MAC address,
And this way, you could get another 15 minutes
each time you reset it to a new, random value.
So, as you can see,
MAC changer can be really useful when you're trying
to impersonate other layer two devices on the network
or for bypassing MAC filtering on a given network.