When it come back.
Friends, in the last video we have seen how we can perform a man in the middle attack based on cash
poisoning.
But this type of attack has some huge disadvantages.
One of them is that you have to constantly send packages to stay active in the cache of this client.
And by sending this over and over again, the client, which is the smartphone over here, will definitely
drop some other packages, which means we are losing information during this type of attack and this
is definitely something we do not want to have.
Also, setting a proxy within device settings is no option for us because it will only intercept HTTP
and http s traffic.
So if the application or the smartphone is sending data via a different service, for example, MQTT,
SIP or maybe FTP, then we do not get these information because they are not related to web services
and therefore those packages will not be forwarded within the proxy settings.
And this is also something we definitely do not want to have.
If we perform a man in the middle attack, we want to see all and not just the single certain protocols.
So how can we do this?
Well, the solution for this one is we do not have to hack this device if we own this device.
So if we go back into our main in the middle setup over here, if we own the router, then we do not
have to poison the cache of this client to perform a man in the middle attack because we are already
men in the middle by having control over this router and this is exactly what the setup is based on.
By controlling the router, we can intercept, sniff and manipulate those packages if they are not encrypted,
but also if they are encrypted we can deal with this.
Regarding to HTTPS, for example, we will learn how to do this later on.
But back to the setup.
If we own this device, we can inspect, manipulate and sniff everything that goes by this device.
And if this one is acting as a gateway, the smartphone is sending every package which is related to
the Internet through this gateway.
And this is exactly what we want to have by having control over this device.
We have control over the whole network connection of this smartphone.
All right.
So which components do we need for our men in the middle setup?
Over here on the left, we've got our smartphone and on the right we've got our attack machine, which
is our Ubuntu VM.
The component that's missing over here is the router.
In my case I'm using a travel router from Tp-link, but the model or brand, it doesn't really matter.
You can choose whatever device you like.
Next we will configure this router to act as a gateway, which means every device we connect to it,
we route the whole traffic through this device.
And this means we are not only intercepting HTTP or https request, we see everything DNS, http, telnet,
MQTT, sip, you name it, we intercept it.
We set up on the first time, requires some steps, but afterwards we will establish a man in the middle
connection in under 20 seconds.
We will we will time this later on.
So, so yeah, it's a little bit of work if you do this for the first time, but afterwards it will
be super fast to re-establish this whole man in the middle setup once again.
Alrighty.
So let's have a look at the configuration.
So the first thing we need to do is we need to disable the DHCP server in the router.
So if you're connecting a device to this router, the DHCP server will provide an IP address for this
device.
And this is something we want to outsource into our attack machine because then we have also full control
over the DHCP settings, which is super amazing.
All right.
So how can we do this?
So the first thing that's required is of course our router.
In my case, I'm using a tp-link travel router, but the brand and model doesn't really matter.
You can choose whatever device you like next.
I would recommend resetting this device because you get back your lost password.
And also, if you have configured this device in a certain way, this might cause some trouble later
on.
If you perform a man in the middle attack resetting a device most of the time the same steps.
What we need to do is we need to connect this device to the power line and then we have to wait until
the device has been booted up once completely, because if you reset the device during the boot up,
this might cause some trouble.
And this is something you definitely do not want to have.
And then we check this device for a reset button.
It's in a small hole and it's behind this hole.
So we need to get some some tiny thing to stick into this which holds down the reset button for a certain
amount of time.
The router needs to be connected to the power line all the time.
After holding this now down for at least I would recommend 10 seconds, we can observe the LEDs on this
device.
They should start refreshing re blinking.
There should be some visible output over here.
In my case it starts completely re blinking all of them after re flashing.
We simply release this button and then put this device back on the table.
Now we wait until the device has been rebooted and then we are done.
We have successfully performed an in factory reset for this device.
Over here we can find all the necessary information, the default password and also the WPA key on the
backside of this device.
And these are now required to connect to it.
All righty.
So after the device has been rebooted, we simply connect to the provided wi fi of this router.
So we simply check out the credentials on the back side.
And if we have no credentials, then the.
The question is does not require any password, which should be immediately changed afterwards.
So after connecting to the file, the router is providing an DHCP service, so we receive an IP address.
In my case I received a19 2.168. 0.100.
Next, we need to look into the interface of this device into the router, and therefore we have to
identify the IP address.
So most of the time it's simply just a gateway address.
0.1 or 0.254.
If this is not the case for you, then we need to look it up on the windows side.
So maybe there are some certain DNS name or on certain IP address, but it should be it should be announced
anywhere on the on the side of the window.
All right.
So in my case, I simply type in the IP address into the browser.
You are because there should be an HTTP server running on this device and here we have it.
This is the interface of the travel router from Tp-link.
The credentials, the default credentials are just admin admin.
So I use them to log in.
After logging, looking into this device, we can find a lot of categories on the left side.
For example, we have quick setup, we have some network settings, some wi fi settings and also the
DHCP settings.
But before we change anything right here, we should change the default password of this interface over
here and also the WPA key because because afterwards, after we have set up this router over here,
it provides an access point which provides access to your internal network, and therefore, this should
be probably secure.
All righty.
Okay.
In my case, I can find the wi fi settings over here and here on the security.
I can now choose a new WPA key.
And this is something I do right now.
Afterwards, I hit the saved button, and then this device might reboot or not.
Depends on the vendor and the product you are using right now in case it's rebooting.
Then just wait until it has been finished.
Okay.
After we have changed this password, decide my stack at a certain point.
So it seems like it's loading and loading.
But yeah, the reason for this is that we have lost the connection because after changing the password,
we have to re-establish this connection, the spy fi connection with the new password we have provided.
Therefore, just simply check your Wi-Fi settings and connect back to this network over here with the
newly set password, then simply hit the refresh button and decide should now probably load already
after changing this for the 2.4 gigahertz settings.
We also should do this for the five g guards, but in my case I'm not using it.
Therefore I simply hit the disabled button.
We can now disabled HTTP server.
In my case I can find the settings over here DHCP and in my case we can see we cannot disable it right
now because we first have to assign a static IP address to this device.
We can do this in the network tab.
So by clicking in the network tab, we can now select static IP and then we can we can select the save
button and afterwards right now we are able to disable DHCP server.
So if you go back then you can see, okay, we can now disable it and that's all we need to do to set
up this device after disabling it.
We will also lose the connection after a while because this router over here does not provide an IP
address to our connected devices.
And if the device is not receiving an IP address in a certain amount of time, it might re connect to
another wi fi.
All right.
So let's recap these steps real quick.
We have set our change default wi fi password.
We also disabled five key settings because we are not using them.
If you are using them, then please also change the by fi password over there.
Afterwards we have set a static IP address for this router and then we have disabled DHCP service in
this route over here.
Which means if you connect the client via wi fi, we do not receive an IP address right now.
All right.
So this is the setup for this device over here.
And the good thing is we only have to do it once.
So after performing all this tasks, we do not have to go into this one second.
All right.
So the router has been set up successfully.
What's next?
Well, the route is not connected to anything right now, so it provides my access point.
But we have to connect it to our attacker machine because the client, the smart phone in this case
will connect to this access point and it needs some sort of Internet access.
This will be provided by the attacker machine.
That's also why we have disabled DHCP server.
Now we need to make a connection from the router to our virtual machine and the best way we can do this
is using and use B two Ethernet adapter in this type.
Over here in real life, it looks a little bit different, but this is an adapter for Ethernet cable
into a USB cable and this is super handy Y because we can simply stick this into our laptop and then
we can provide this whole Ethernet interface to our virtual machine.
I mean, in case you are not using a virtual machine and you you get your internet connection via wi
fi, then you can of course use also your Ethernet port on your real machine.
But most of the time I'm working with virtual machines and this adapter comes super handy.
All right.
So this adapter has an Ethernet interface and also in use B interface.
And we yeah, we click this together.
Okay, seeing all these devices on a slide is not really helpful.
And therefore, let's figure it out how we put them together in the reword over here.
All righty, let's go.
Okay, so here we have our router, our travel router, but we have successfully disabled HTTP.
We have an Ethernet interface over here and we've got some other connections.
But most important is Ethernet and power.
Then we've got this USB to Ethernet adapter and this looks like this one over here.
We've got an Ethernet interface and we use the interface.
Next we take our Ethernet cable and then we simply put all these components together.
The Ethernet cable will be plugged in into this switch of the router and the other end will be inserted
into the USB to Ethernet adapter like this one over here.
Next we connect the USB adapter to our laptop, our physical machine over here.
By having the USB adapter, we can forward this interface to our virtual machine.
That's why we are using this adapter.
The printed model doesn't really matter, but please take care.
If this USB adapters regarding tool 3.0, then your laptop should support this right now.
Otherwise please make sure that you're buying an adapter that has USB 2.0.
Alrighty.
After connecting everything together, we provide the power line to our router over here.
In this case, it's simply a mini USB cable.
We plug it in into the router and then we wait until the setup or the boot process of this router has
been finished.
And that's all.
This is our man in the middle setup.
So if you want to perform this once again, we simply need to put these components together and we are
done because we have already disabled DHCP server in the router and therefore we can simply re-use it
as it is.
Stick together right now.
Okay.
So here we are back on the slides.
We have put everything together.
We've got our router which is connected to the USB two Ethernet adapter, which is connected to our
tech machine.
The thing that's missing right now is the DHCP and the DNS service, which means if we now connect the
client to the access point, decline does not receive an IP address.
And this now sounds super complex because we need to set this up on our attacker machine because we
want to have full control over this and we also want to reroute the traffic through our machine.
But don't worry, we do not have to install or set up anything.
There's some kind of magic happening in the background that serves our task, which is super amazing,
right?
The magic command for this one is the network manager.
So if you type in RN Connection Editor, we can see a new USB interface and the only thing we need to
do to provide the HCP and DNS service is selecting within the IP before settings shared to other computers
and setting this connection to share to other computers.
We do the following.
We have our our real internet connection, which is provided by a not.
And now we can share this connection to other devices.
So by setting it to share to other computers and DHCP and DNS service, we run on our system and we'll
automatically forward everything on this interface through our Internet connection to the outside world.
We do not have to care about re routing, about the HTTP settings, DNS entries or anything.
All of this done is happening magically in the background.
Of course, if you want to, we can take control over this and we can provide additional DHCP entries
and DNS entries, which is super handy.
We can verify that everything is working if the client is receiving an IP address in the range from
1040 to 0 and then the Class C nets.
So in our case, the client, the smartphone receives an IP address 156 our gateway, which is now the
use V two Ethernet adapter, should definitely have the IP address 1042 0.1 If you receive this IP address
on our USB to Ethernet adapter, everything is working properly, so we are done with our man in the
middle setup.
Additionally, of course we also have the DNS service running in the background that resolves all those
hostnames.
And this is also super amazing because let's say the client is smartphone over here wants to connect
to example dot org.
Now as an attacker over here we can provide the IP address for example, dot org, which means the client
does not have to connect to the outside domain.
They can simply reroute this traffic to our local machine to the attacker.
Therefore, the smartphone is not leaving our network and we can mock up services and provide our own
services in our own network.
Super great, right?
Absolutely.
But before we just keep talking about this, let's simply finish our man in the middle setup, because
most of the work has been already done.
The only thing that's left to do is simply providing those two services to our USB to Ethernet adapter.
And this can be done with just a single mouse click.
Alrighty.
And let's go.
Let's switch to the Ubuntu VM and have a look how we can set it up.
All right.
So here we are now with our Ubuntu VM.
And the first thing we need to do is we need to forward the USB interface, the USB to Ethernet adapter
to this virtual machine over here.
You can do this within the settings of your VirtualBox or VMware or whatever virtualization you are
using right now.
After doing this, we can simply verify that everything is working by typing in if config.
If the adapters compatible to your system over here, you might not have forwarded it into your virtual
machine.
So simply check the USB settings on your virtual machine and see if this device is available over here.
If yes, simply just click a connect to this virtual machine and we should be good to go.
And there we go.
I have now connected or forwarded this USB interface to my virtual machine over here.
In case if you have trouble, please make sure that the adapter you are using is compatible to your
laptop.
So for example.
So for example, if your laptop doesn't support USB 3.0, then the adapter also needs to be used be
2.0, otherwise it might not work.
Also, please make sure that the USB interface in your virtual machine is supporting USB 3.0.
In my case, I have to select the separately, so USB 3 to 0 is not selected as the default connection.
Therefore I have to go into my VMware settings and under use p.
I have to select 3.0.
Otherwise this virtual machine doesn't also support 3.0 devices.
All right.
In case of any other questions or trouble or that you stuck at a certain point, please write me a message.
We will figure this out together and we will make it work for you that you can see your adapter over
here.
All righty OC.
Also, please do not get distracted by all these connection fade messages.
This is absolutely perfect because we haven't set up this connection yet.
Therefore, let's have a look into this.
I'm opening the terminal and I'm typing in iff config.
And now there we go.
Here we have notice at.
Up that this is my USB to Ethernet adapter and the name is a little bit strange.
We've got this index, but this one over here, that's the Mac address of my adapter.
You can find it over here.
This one.
So if you see this right now, then it's absolutely perfect.
The only thing we need to do is we need to provide the DHCP and DNS servers to this adapter and this
sound super complex, but it's some kind of magic within the network manager.
So therefore, we go into the network manager and we can do this by typing in an m dash connection.
Dash Editor.
So here we have now two interfaces.
This one, this is our NAT interface of our virtual machine.
And this one, this might be our use P two Ethernet adapter adapter clicking it.
Yes, we can see the device name.
This is our USB to Ethernet adapter.
Therefore I also provide some suitable name right now that I will recognize it later on more easily.
The USB to Ethernet adapter.
All right.
And now how can we provide DHCP and DNS to this interface over here that this connection, the USB connection
does automatically forward every traffic to our NAT interface, to the real world, to the to the Internet
world.
Well, it's amazing how easy this is.
All we have to do is we have to go into IPV four settings and then we have to select instead of instead
of automatic DHCP share to other computers and then hit the safe button.
That's all we had done with our man in the middle setup.
Isn't this awesome?
Absolutely right.
So if you close this one over here and now if we if we type in if conflict once again, there we go.
We can now see we have a gateway address.
This UDP two Ethernet adapter is now Gateway with the IP address 10.40 2.0.1.
At this point, we are done.
We have set up our man in the middle connection.
At this point we are done.
We have successfully set up our man in the middle connection.
If we now connect the client, for example, this device over here, this one, that's a real smart
phone.
If we now connect this device to our access point, our FTP service will provide an IP address within
this range over here.
And if the smart phone tries to connect to the outside world, the traffic will be automatically routed
through this interface over here into this one, which is our NAT, which is the Internet side of our
of our connection over here.
Let's test this.
Let's see if it's really that easy.
So here we have our real device, this smartphone.
We are just transferring the screen to this machine that you can see what's going on.
We can see no Wi-Fi connection yet, so we simply go into the Wi-Fi settings.
And then we select our Tp-link network.
Why?
Yes.
In your case, I mean, you've gotten different as a side.
It's regarding to the access point you have chosen.
Next, we have to provide the WPA key and this one has been changed during our initial setup.
So in my case, it's the following.
Of course, I'm not going to show or type this right now.
I will fill it out automatically.
Okay.
Before we hit the connect button, let's sniff on this interface, this one over here, to make sure
that we are really seeing every connection right now that we have successfully performed a man in the
middle attack.
We can do this with Wireshark.
So Wireshark is some.
Yeah, it's a network sniffer and we can tell Wireshark to listen on this interface and sniff or record
every package that's passing this interface.
So in case if you haven't installed Wireshark, it's very easy.
We can simply run sudo update install Wireshark.
In my case I have it already installed and yeah if you start it for the first time there might be some
kind of initial setup.
But I guess the only setting we have to choose is if you want to allow non road users or non sudo users
to capture packages.
And I deny this one because I do not want any other users then route be able to capture those packages
afterwards.
We need to run by a shack with sudo privileges.
This means we are running Wireshark as a route user.
We are sniffing on an interface and this requires root privileges in case if you happen to select the
differently.
Okay.
Here we have now all these interfaces and yeah, in our case or in my case right now it's this interface.
This is our USB two Ethernet adapter.
So here we can see nothing is going on.
Absolutely.
Because there's no client connected right now.
Therefore, there's also no traffic on this interface.
Of course, sometimes we can see some broadcast messages, but it's it's it's not really much right
now.
And let's put this now side by side.
There we go.
I hit the connect button and then let's see what's going on.
We hit Connect.
And there we go.
We can see the HCP some broadcasts and there we go.
Here's all the traffic from the smartphone.
Right now, it's listed in Wireshark.
There's a lot of stuff going on.
We can see the Wi-Fi connection has been now established and our client seems to have this address over
here.
Nice.
It seems to work pretty awesome.
We can verify this right now because yeah, this could be all kind of traffic.
Let's see if it's really the traffic from the smartphone over here.
We filter for HTTP and here we can see the smartphone has made an request to this destination address.
We can now right click into this and then we can say follow the HTTP stream and then we can see, okay,
our smartphone has generated the following request, but we didn't receive something back from the server.
So that's not a reliable yet reliable case to verify that we are men in the middle in this device.
And so the better approach would be to simply sniff a direct connection.
For example, if you're opening the web browser of the smartphone and then opening a web page in Wireshark,
we should see the request packages and also the responses from the server.
If you have successfully established a man in the middle connection, therefore let's check this out.
If it's working so we can close this one over here and then we reset this filter so that we see everything
right now.
Okay, then I open in Chrome and I'm generating a new tab, a new Incognito tab.
Okay.
And now I'm opening a http example dot org.
And now we can see, yes, we have some HTTP packages over here.
We can click into this green connection, right click, follow TCP stream or we can go into the HTTP
package.
Click on this follow HTTP stream.
In this case, we only see the HTTP related packages and we can see yes, we have requested example
dot org in red.
This is the client.
We can also find this information here and the server is responding with the following.
Here is the HTML content of this page.
Nice.
It's working.
We have successfully established a man in the middle connection.
Freaking awesome.
Right.
We can also redirect this traffic by providing additional DNS entries.
For example, we can make example dot org to point to a local system to us.
Then the smartphone is not even leaving our internal network.
So it thinks that this one is the correct server.
We can do this by adjusting the DNS mask conflicts and some other fancy stuff.
So the only problem we're having right now is regarding to encrypted packages.
So for example, if we delete this filter over here.
And if you scroll down, there we go.
Here we can see we have some TLS connections.
And this is the case if you're opening an HTTPS page.
So for example, if you're not calling or opening example dot org.
HTTP example dot org.
If you're opening https example dot org, then we can see over here on the left side, we are generating
some TLS packages and TLS is the HTTPS encryption.
So there is an encrypted channel in our connection.
We can also take a look at this one of course, by right click follow and then TCP stream here we can
see the beginning, so maybe we see something in SE entries, but afterwards everything is being encrypted
so we cannot see what's going on in this connection.
And that's good.
I mean, this is why we have HTTPS, but in our case right now, we want to see what the device is sending.
For example, if we're analyzing a mobile application and this one is communicating with the back end,
we need to intercept and inspect this this connection.
And if it's being encrypted, we need to figure out how we can deal with this.
And this is something we learn in the next video.
But for now, I want to show you something really amazing because the question is how fast is the set
up?
So how quickly can we re-establish a man in the middle connection setting it up on the first time over
here?
It did require some effort.
Absolutely true.
But if you have done this once and let's figure out how fast we can re-establish this man in the middle
connection.
All righty.
So let's do this together and let's close this over here.
Let's keep Wireshark running that we see.
We are losing this connection.
All right.
And now I'm plugging off the USB to Ethernet adapter, so.
Now the adapter has gone and we can see network adapter and so on.
It's not running anymore.
We also will lose the Wi-Fi connection in a short amount of time because the DHCP service has gone and
therefore the smartphone has no connection anymore.
There we go.
So the Wi-Fi settings has now gone.
Okay.
We also see this no Internet connection.
Okay, let's figure out how fast we can re-establish this connection.
The only thing I need to do is I need to restart Wireshark because, yeah.
Removing an interface while Wireshark is still being opened, it will cause some trouble and it will
crash later on.
Therefore, we do not see our our attack is being working.
Okay.
So now I have restarted Wireshark and we can see the smartphone still got no connection.
We've got Wireshark on the left.
We can see no interface.
This is our starting point when we want to perform a man in the middle attack.
So we only have the devices stick together, the USB adapter to the router, the router to the power
line, and the USB adapter to our machine over here.
We have forwarded this interface and now let's see how fast we can re-establish this connection.
All we need to do is I simply need to plug in the USB adapter into this machine because the network
manager doesn't need to be configured anymore.
It still keeps its configuration.
Therefore, by plugging in the USB adapter to this machine, the network manager will automatically
recognize this interface providing DHCP and DNS service based on the share to other computers connections
and the DHCP service will be still disabled in the router, so we do not need to configure our change
anything.
Right now.
All we have to do is we have to plug it in into our computer.
Alrighty.
Okay.
So let's see how fast we can re-establish this connection.
I mean, the part was on, I guess, 20 seconds.
So let's see if this works out.
I will keep my hands visible as far as possible, but I have to I have to connect the USB interface.
Therefore, I'm doing this right now into my hands.
I'm not doing anything.
So let's see.
Wireshark has now this interface and on the right now we've got also our Wi-Fi connection.
So everything has been set up perfectly.
We can see we are back online, but are we also meant in the middle?
Therefore, I have to select this interface.
Be it stopped and let's see.
We do not see any requests right now, so we have to wait until the smartphone makes requests.
And there we go.
It sends out some quick packages, whatever they are.
But we can see, yes, we have reestablished this man in the middle connection.
So that's all we need to do right now.
He's set up.
Yes.
It was a little bit of a mess for the first time.
But reestablishing this right now, super easy.
Nice, isn't it?
Okay, so this is how we can set up or establish a man in the middle connection.
And by having the setup, we are able to see everything, every single request of the smartphone and
we are also able to manipulate certain important network informations, for example, the HTTP settings
and also DNS settings.
All righty.
So the thing we cannot do right now is we cannot manipulate these packages in Wireshark.
We only see them, but we cannot intercept, modify and yet reformat them.
This is something we are going to take a look in the next video and I'm super excited about this.
We also learned there how to deal with HTTPS connections, so how to break off as a.
Alrighty, I'm super excited about this one but yeah, feel free to play around with this setup a little
bit.
And afterwards we have a look in dealing with HTTPS connections.
Alrighty.
Okay.
I'm super excited and I'm looking forward to see you in the next video.