L in u X ba sics for h acke rs g e t t I n g s t a r t e d w I t h

Spoofing Your MAC Address
You can also use 
ifconfig
to change your MAC address (or 
HWaddr
). The MAC 
address is globally unique and is often used as a security measure to keep 
hackers out of networks—or to trace them. Changing your MAC address 
to spoof a different MAC address is almost trivial and neutralizes those 
security measures. Thus, it’s a very useful technique for bypassing network 
access controls.
To spoof your MAC address, simply use the 
ifconfig
command’s 
down
option to take down the interface (
eth0
in this case). Then enter the 
ifconfig
command followed by the interface name (
hw
for hardware, 
ether
for Ethernet) 
and the new spoofed MAC address. Finally, bring the interface back up with 
the 
up
option for the change to take place. Here’s an example:
kali >ifconfig eth0 down
kali >ifconfig eth0 hw ether 00:11:22:33:44:55
kali >ifconfig eth0 up
Now, when you check your settings with 
ifconfig
, you should see that 
HWaddr
has changed to your new spoofed IP address!
Assigning New IP Addresses from the DHCP Server
Linux has a Dynamic Host Configuration Protocol (DHCP) server that 
runs a daemon—a process that runs in the background—called 
dhcpd
, or the 
dhcp daemon. The DHCP server assigns IP addresses to all the systems on the 
subnet and keeps log files of which IP address is allocated to which machine 
at any one time. This makes it a great resource for forensic analysts to trace 
hackers with after an attack. For that reason, it’s useful to understand how 
the DHCP server works.
Usually, to connect to the internet from a LAN, you must have a DHCP-
assigned IP. Therefore, after setting a static IP address, you must return and 

---

Analyzing and Managing Networks
33
get a new DHCP-assigned IP address. To do this, you can always reboot your 
system, but I’ll show you how to retrieve a new DHCP without having to shut 
your system down and restart it.
To request an IP address from DHCP, simply call the DHCP server 
with the command 
dhclient
followed by the interface you want the address 
assigned to. Different Linux distributions use different DHCP clients, but 
Kali is built on Debian, which uses 
dhclient
. Therefore, you can assign a 
new address like this:
kali >dhclient eth0
The 
dhclient
command sends a 
DHCPDISCOVER
request from the network 
interface specified (here, 
eth0
). It then receives an offer (
DHCPOFFER
) from the 
DHCP server (192.168.181.131 in this case) and confirms the IP assignment 
to the DHCP server with a dhcp request. 
kali >ifconfig
eth0Linkencap:EthernetHWaddr 00:0c:29:ba:82:0f
inet addr:192.168.181.131 Bcast:192.168.181.131 Mask:255.255.255.0
Depending on the configuration of the DHCP server, the IP address 
assigned in each case might be different.
Now when you enter 
ifconfig
, you should see that the DHCP server has 
assigned a new IP address, a new broadcast address, and new netmask to 
your network interface 
eth0
.