Welcome back.
Let's start with our first tool that we're going to use to perform our spoofing and men in the middle
attack now for this type of the attack.
There are many tools out there that you can use to initiate this attack.
Some of them are outdated.
Some of them are already preinstalled in clinics.
However, we are going to cover one of the most known tools, which is called better cap.
It is a little bit harder to use.
However, we're just going to cover the basics of it.
So let's open up our terminal.
And since this tool is not already installed in clinics, we must install it first.
And my advice would be for this entire section to run all the tools as a route account might be asking
why.
Well, we're going to perform on two different networking things and some of the networking things could
require route privileges.
So some of the tools might not run.
Some of the settings might not work if we run it as a regular user inside of our clinics.
So let's real quick enter the router terminal.
And to instill our better capital, we can simply type the command and get install and then better kepp
press, enter press, why once it asks you do you want to continue it now, we're going to wait for
the better cap installation to finish and then we're going to enter its framework and perform a mid-term
attack.
OK, it is finished now.
There are two ways that we can run this attack, we can run it as a comment by specifying a file that
contains all of the better kept comments that we want to run or we can run it inside of the framework.
Now, for the first time, we are going to just type better, kept to open the framework and we're going
to experiment with different commands in order to run this attack.
And then after this, we're going to see how we can run it just from a terminal in a one line command.
OK, so once you take better care, if it's end of your terminal, it will open the better care program.
It will tell you which version it is.
And it will also tell us to type help for a list of the commands.
So let's type help to see what options do we have.
And right here we're going to see a bunch of available services that we can run.
We'd better get most of these services are not going to run, as it says right here, not running.
And the only one that you will see running is events dot stream.
Now, you might already start to notice something interesting for us, such as, for example, this
AAFP spoof.
We talked about our spoofing, the previous video, and we know that this is the base of our men in
the middle attack.
However, before we get to it, let's go a little bit up and check out the help menu.
So these are the commands that we can use with better.
Kepp we can type help and then some module name.
In order to print out more information about that specific module, we can also active quitte sleep
for a certain amount of seconds.
We can set value the same way that we do inside of our MSF console.
If you remember, once we set values for certain payloads, we do that using this command so we can
assume that this is something similar as MSF consul or at least has similar options and commands.
Now, let's go down to these modules.
And before we actually get to this our module, let us take a look at this net probe module.
If I simply just type help and then let that probe.
This will give me the help menu and the description of this module.
So as it says, it will keep probing for new hosts on the network by sending the packets to every possible
IP on the subnet.
In other words, what this module will do is it will discover all of the online hosts inside of our
local area network.
So what we can do is we can turn that on to start network hosts probing in background.
Let's run this comment, as it tells us right here.
Cofidis.
Based it right here and let's press enter.
And we can already see that it managed to discover some of the hosts inside of my network.
These are the active IP addresses right here.
The next thing that we want to do is want to type the help menu for the AAFP dot spoof module.
So just type help or that spoof and press enter.
And we also get the option as to how we can run this model, but down here we can see some additional
options or as it says right here, parameters for this module.
We got our that's proof that full duplex.
We got our internal our that's the targets and our that prove that whitelist in this specific scenario.
We're interested in these two.
So the full duplex and the targets, the full duplex, if we read the description, if this is set to
true, both the targets and the gateway will be attacked.
Otherwise only the target.
And as it says right here, if the router has our spoofing protections in place, this will make the
attack fail.
So in some networks and on some routers, this attack will not work because more and more routers nowadays
are starting to implement the ARB spoofing protection.
However, if it is not enabled, if the protection is not enabled, then we can perform this attack.
So what we must do is we can type set up that proof, that full duplex to be equal to the true or just
set it to true press.
Enter right here.
And we also want to set the targets.
Now, you can specify the entire subnet or the entire network or you can do it like I'm going to do.
I'm just going to select one target.
And the reason why I'm selecting one target is because once you've done this on the entire network,
there is a lot of information going inside your terminal and it is going really fast.
You don't even get to read it.
Therefore, what I'm going to do for the purposes of this tutorial is I'm going to select the IP address
of my Windows 10 machine that we are going to perform the midterm attack on, and then I'm going to
set up that spoof dot targets to be equal to that IP address just like this.
Once they do this, I want to start sniffing for network connections, and we can do that if I go up
here, we can see that there is a module called net that sniff if I type help, not that sniff.
It will just say that this will sniff packets from the network and recommend it for you start.
It is not the sniff.
But before we actually start it, let's go and check out the parameters right here.
The parameter that we want to use for this attack isn't that sniff that local as it says.
If this is true, it will consider packets from to this computer, otherwise it will skip that.
Now, once we start to attack all of the packets from our target machine, we'll go to this computer.
Therefore, this will be able to sniff them.
Let's go with this.
And paste it right here and what we want to do is we want to set this to true.
After we get all of these settings ready, we can type up that spoof and we can set this on and we can
also tape net that sniff on press enter.
And this will start sniffing packets on our Windows 10 machine.
We can also see some of the queries that our Windows machine is making.
And if I go and try to visit some Web page.
We can see that our target machine is querying Facebook.
As we can see, the desktop machine initiated the request for w w w dot Facebook dot com, and this
will work for any other website.
We can see the requests for Twitter dot com, and if they were to input a password to an unencrypted
website, such as for example, let's say that they want to connect a router and go right here and they
type, for example, test and test and click on login.
If I scroll a little bit up, we should manage to find the request where they send the password.
And here it is, here is the request where they send the password, we get the username test and the
password is how hash value, however we manage to get it.
Nonetheless, it will work for any website that sends unencrypted data, for example, onto this website
called Phone Web.com.
If you go to first link, which is this one, and I click on login.
Type user name admin and password test, I click on login.
And for some reason, it seems that it didn't manage to get its legs grow a little bit up to see whether
we can find it, and here it is.
Here is the packet that we sent, including the username and password.
We managed to sniff it from our Windows 10 machine.
Here is the username admin and the password test.
Great.
This is one way that you can use better, kepp another way that you can use better.
Kepp is if I exit out of this program, it will automatically start the Arab spoof and it will restore
our cash for our targets.
And the way that we can run it with the comment is we can just create a file called Sneve Cap.
And inside of this file we can type the commands that we typed previously, which is not the probe on.
We also want to select our DOT spoof dot full duplex to choose in order to also prove the target and
the router.
And we also want to select AAFP dot spoof dot target to the IP address of our target machine.
After that we set the net dot sniff that local to choose, which means only if the packets that are
coming from and to this machine and then we pipe are both on and that dot sniff on.
These are all of the commands that we must run.
So all we need to do is save this in a file called Sneve, that cap, and then we can run the command
better.
Kepp that I face and efface stands for Interface where we need to specify the interface of our machine.
Since Oncolytics, the only active interface that they have is zero.
Once it specified that all they need to specify is another option, which is dash capelet and then the
name of the file containing our commands.
And this will do everything that we just did automatically.
So if I press enter, it will set all of the settings that we did and it will start sniffing for different
connections.
For example, if I go right here and try to refresh Facebook.
It will sniff that request to Facebook, and this is one way that we can perform men in the middle attack,
in the next video, we're going to check out another tool that will allow us to perform this attack
that you might actually find a little bit easier to use.
Thank you for watching.
And we'll see you in the next video.