+---------------------------------+
 WinARP Man in the Middle 0.9.4  
 http://www.arp-sk.org             
+---------------------------------+

winarp_mim is a tool for an ARP man in the middle attack. You can
use this for sniffing in a switched network.

It needs the WinPcap driver available at http://winpcap.polito.it/
and works on Win9x/Win2K/WinXP.

winarp_mim works in 3 steps :
  1- Send an ARP request packet to target A and target B.
     For target A the [ARP sender IP address] is IP address of B and
     the [ARP sender MAC address] is the MAC address of our selected
     adapter.
     For target B the [ARP sender IP address] is IP address of A and
     the [ARP sender MAC address] is the MAC address of our selected
     adapter.

  2- This fake state of the ARP caches (A and B) is maintained with
     ARP reply packets. The informations of ARP sender fields are the 
     same.

  3- With the ending of the attack two more ARP request packets are
     send. This packets contain the true informations.
     For target A the [ARP sender IP address] is IP address of B and 
     the [ARP sender MAC address] is the MAC address B.
     For target B the [ARP sender IP address] is IP address of A and 
     the [ARP sender MAC address] is the MAC address A.


-- Options --

WinARP Man in the Middle version 0.9.4

usage: winarp_mim.exe -a target_a_ip -b target_b_ip 
                     [-t delay] [-c count] [-v]

Options:
  -a  IP address of target A
  -b  IP address of target B

Misc. options:
  -c  number of packets to send [infinity]
  -t  time between successive packets in ms [2000 ms]
  -h  help
  -v  verbose


-- Options description --

-a: IP address of the target A.

-b: IP address of the target B.


[Miscellaneous options]

-c: set the number of packets to send.
    Default : packets are send until a key is hit.

-t: set the time between successive packets in ms.
    Default : the delay is 2000 ms between two packets.

-h: help

-v: verbose mode for additional informations about packets.


-- Note --

The man in the middle works transparently only if the attacking
host use IP routing.

The activating of the routing for :

  1- Windows NT : in TCP/IP panel configuration

  2- Windows 2000 : change or create the value 
  SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 
  IPEnableRouter=1

  3- Windows 9x : change or create the value :
  \HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Vxd\Mstcp\
  EnableRouting as a STRING Value with value 1
  (Note: "EnableRouting" is case sensitive) 


-- Authors --

[Lead developer and maintainer]

Eric Detoisien  - <eric_detoisien@hotmail.com>


[Lead Coordinators]

Cdric Blancher - <blancher@cartel-securite.fr>
Frdric Raynal	- <pappy@miscmag.com>

