The ArpSucker is b0rn! Be yourself, be the net.

From: Alpt (
Date: 09/13/04

  • Next message: Adam: "Re: [Full-Disclosure] Where is security industry gng??"
    Date: Mon, 13 Sep 2004 22:05:16 +0200

                   Freaknet Death C is pride to present ya:
            }----------------- (The ArpSucker) ----------------{

    Hi folks,
    Did you ever dreamed to become the net, to be a big, bad, black, black,
    black hole?
    Yep! I did.

    This code was made the "12 Sept 2004".
    It started to dawn and I, Tomak and Nirvana, after eating some food,
    started to rave.
    Tomak downloaded; But I also wanted to give my good amount of death.
    So I told: <<Why not fakeip?>>. Tomak: <<Yea, good idea, but why don't
    you wake up all those sleeper with a sane System of a Down's song?>>
    After a while,
    I started to code TheArpSucker...
    Then Elibus, Pallotron were my favourite guinea pigs for direct attacks.

    The idea is simple: we add all the ip we want to become in the arp cache of
    all the machines. Yes, it's the normal arp poisoning, but we want to become
    The tests of the global arp cache smashing were successful, I became the entire
    10.0.0.x and 10.0.1.x network. All the packets went to me and, with the ip_forward
    activated, I resent them to the real destination.

    Then when I tried to become all the 2^32-1 IPs, I realized that the attacked machine
    (elibus and pallotron, eheheh), were under a mortal DoS. The Elibus' machine was
    constantly at 100% of cpu until Elibus unplugged the eth0 cable, while the Pallotron's
    machine went in kernel panic!. Elibus uses an x86 arch with the linux kernel, pallotron
    uses An Apple I-book, with MacOsx.
    Asbesto was giving his blessing to spread death in our bicazzo network, and Elibus died
    because he didn't want to share his gprs connection, AHHAHAHAHA.
                            - E l i B u S -
                        He was a good guinea pig
    That was an happy day!
    So, here it is the code, Here I spread the src in the wired.

    The ArpSucker is a patch to arping of iputils:
    You can get the right version of iputils here:

    These are the .md5 files:

    Have Fun

    Fuck to `cat /dev/urandom`
    I love ya

    "I don't know nothing" The One Who reached the Thinking Matter   '.'
    [ Alpt --- Freaknet Medialab ]
    [ GPG Key ID 441CF0EE ]
    [ Key fingerprint = 8B02 26E8 831A 7BB9 81A9  5277 BFF8 037E 441C F0EE ]

  • Next message: Adam: "Re: [Full-Disclosure] Where is security industry gng??"

    Relevant Pages