Welcome back.
In this video, we're going to take a look at cool way that we can actually perform our spoofing or
are poisoning manually.
We're going to do that using our huge library that comes with Python three, and that is called this
kepi library.
Now, Skype allows us to manipulate different networking packets, and we can also send and receive
the packets as well.
Now, we could do something like this with the help of a socket library, but that would be much, much
harder because with the help of Skype, we have all of the packets already predefined and we can just
craft them to our liking.
Now, the same way that you can open Python inside of the terminal, you can also open escape inside
of the terminal, and this will allow you to write the code line by line.
So it will take a few seconds to open this framework.
And once it opens up, you will see this escape banner and then you will be able to run the commands
right here.
Skype works similarly to Python, so you can use the print statements to print Hello World, for example,
and it will also run that code as well.
However, we're not going to use it for this.
We're going to use it to craft packets.
For example, there are better headers inside of a packet and to see all of the fields that and Aitor
header as we can type URLs and then Aitor the same way we can do for our packets.
For example, if I type AAFP inside of the brackets, it will give me all of the fields that an ARP
packet has.
And you can do that for any packet that you want.
For example, you can also do it for DCP Packet and it will give you all the fields that the TCP header
has and then you can change each of these fields to your liking.
But as I already mentioned, the goal for this video is for us to craft an art packet that will poison
the ARP cache of Windows 10 machine and that will tell our Windows 10 machine that we are the router.
So how can we do that?
Well, first, if you remember, we must know the Mac address of our Windows 10 machine to be able to
send the poisoning packet to it.
Now, we are not going to cheat and check out the Mac address inside of the command prompt on Windows
10.
We're going to get it using Skype.
To do that, we must send our request that we request the Mac address of the Windows 10 machine.
To do that, we must also send that request to the broadcast Mac address, which, if you remember,
means that every machine on the network will receive that request.
And then hopefully our Windows 10 machine will reply with its Mac address.
So to do that, let me see if I can use clear command right here.
OK, great.
I can use it to do that.
We are going to combine the other header that we just checked out with the AAFP header or the art packet.
The reason we need the letter, Heather, is so we can specify the destination Mac Field to be the broadcast
Mac address.
Therefore our our packet will be received by anyone on the network.
Let's do that.
So let's create a variable called broadcast and this variable will be equal to atter header and the
best field, which is the destination.
We can set the broadcast Mac address, which is for everyone six times f f separated by two, that once
you do that you can close the brackets.
And now we've got our broadcast packet ready to check out whether everything is selected correctly.
We can type broadcast that show and this will show all of the fields that we have right here.
And you will notice that it will automatically set the other two fields.
This is the Mac address of our Linux machine, which is the source Mac address, because we are sending
the packet from our Linux machine and the destination is to who we are sending the packet.
In this case, we are sending the packet to everyone.
Now, what we must do is we must also create the R player to this packet.
And to do that we can type s our first to check out all of the fields and we want to target the Windows
Ten machine because we want to get its Mac address.
So what we must do is we must type the P destination to be equal to the IP address of Windows Ten Machine.
All the other fields will be set automatically for us, except this hard for destination field, which
is the Mac address of our target, which we get from the ARP response.
So to craft the player, we can type our player equals and then AAFP and inside of the brackets we specify
the fields that we want to use.
In this case, we only specify the destination to be equal to one and to that 168 that fund at seven.
Or you can just specify the IP address of your target machine press enter.
And before I explain this, I can just type out that show to show you how the packet looks like so it
will select the hardware source to be our Mac address.
It will select the IP source to be our IP address.
It will select the IP destination to be the target's IP address, which in our case is 190, the 168
Advanta seven.
And the hardware destination will be empty because this is the value that we want to get back.
This packet is essentially saying who has one eye to that 168 font, that seven?
Give me your Mac address.
And to combine this packet with our broadcast layer, we can type in to underscore packet equals broadcast
slash AAFP layer and this will put our two layers together.
If I type and underscore packet to show you will see we have both the Ethernet layer and the AAFP layer.
Only thing we must do right now is we must send this packet to our network.
We can do that using SRP function and this function takes arguments of entire packet.
We can also set the time out to be too, and we can set the verbose to be equal.
The true.
Now, this is not something that we want to send.
We want to stop the response inside of the answer, because if the Windows 10 machine answers, we will
have our answer with the Windows Ten's Mac address right here in this variable.
We also want to only get the answers and not the unanswered packets.
And we can do that by specifying right here zero to select the first element inside of the list.
Once we do that, we can press, enter and we get operation not permitted.
And that could be because we are not through to count.
So what I'm going to do is I'm going to run this real quick as route.
So I'm just going to write all the commands that we just did.
And I will get back to you as soon as it gets to the SRP command.
OK, so here we are now.
We made a mistake that I already talked about.
We must run all of this as a vote count.
Otherwise, some of these comments will not work.
And I just typed all of the previous commands that we did, such as setting the broadcast layer our
player and creating the entire packet.
Now we're sending the entire packet with this command and we're storing the response in the answer variable.
So let's press enter and it will tell us finished sending one packet, received one packets back and
got one answers not to get this answer.
It's a little bit tricky.
So if I print answer, we will get this response right here.
And since all of these are empty, we want to select this other part right here and print just that
part.
To do that, we can type print answer and then the first element, which will be the answer packets.
So in the brackets we specify zero press enter.
And this is our response from the Windows 10 machine.
If we take a look at the response rate here, we're going to see the Mac address of Windows 10 machine.
So we successfully received it with our packet.
Now we can either keep it from here and store it in a variable or we can select it like this.
So we're going to print the answer.
And from the answer, we are selecting the first element and from the second list we are selecting the
second element and we are going to type dot h w.
S our C and the reason we are using H WASC is because this is the field that has the Mac address of
our Windows time machine or of our target machine.
Then if I print this, it should print just the Mac address and here it is.
And all we need to do right now is copy this.
And stored that in a variable that we can name Target Mac address equals, and then our answer with
the H w sauce felt great.
Now we got our target's Mac address and we're ready to craft the malicious art packet.
So what we can do is we can type something like this.
The packet will be equal to our packet and we're going to select the open field to be equal to two.
Now, if you type Alsup, you're going to see the open field.
And this open field is simply just asking, are we sending our request or our reply once we select the
field?
To be equal to this means we are sending an ARP response and remember to send a malicious R packet.
It must be an ARP response, telling the router that we have Windows 10 machine or something similar
to that.
Once we set the OP to be equal to do, we must set the hardware destination to be equal to target,
underscore Mac, underscore address.
And from here we are selecting two more fields which are destination to be the IP address of our target.
So this simply means that we are sending this packet to our target.
And the last part is where we add the malicious thing here under the P source in a real packet, in
real communication.
We would specify right here the IP address of our clinics machine.
But in this case we want to pretend that we are routers.
So we're just going to specify the IP address of the router.
And this right here is our malicious packet.
If we type packet that show, you will see it right here.
We have the Mac address of our Linux machine, but we also pretend to be the router type diverters IP
address instead of our own.
And this packet is being sent to this destination.
Now, before I send it, I'm going to open the command prompt on my Windows 10 machine and I'm going
to run the Ardeche, a command from the previous video just to see how the ARPA tables are currently
being set.
So we can see that the router, which is in my case, 192 DOT 168, that one that one has this Mac address.
Our clinics machine, which is 190 to 160, added one to 10, has this Mac address, and you will notice
once we send this packet, this IP address, which is our clinics and the routers IP address, will
have the same MAC address.
And that is an indication that they are spoofing attack is taking place at that specific time.
So let's send the packet and to do that we can use the function.
The first argument is going to be the packet and we can said they were both to be equal to false and
press enter.
If I go back to command prompt and type Aatish again, we can see now Sprouter has the same Mac address
as our Cal Linux machine right here.
So we successfully are poisoned, our cash of our target machine now that we did this, you probably
now fully understand how our poisoning works.
And you can also take a look at different tools online to see if there are some better tools that you
can use to perform an intermediate attack.
Some of them have more options.
Some of them have less options.
But nonetheless, this is all it is about this attack.
You simply just send a malicious are packets and redirect the connection to you.
So thank you for watching this video.
And I will see you in the next section.