Instructor: Welcome back.
Let's cover another tool that we can use
for man-in-the-middle attack.
And this tool is called similar to the previous tool
from the last video.
This tool is called Ettercap, just without B.
Now, unlike the previous tool,
we already have this pre-installed
inside of our Cal Linux machine.
And this is a graphical interface tool.
So it might be a little bit easier for us to run it,
and let's give it a try.
What we must do first is we must open the terminal,
and as I already mentioned in the previous video,
let's run all of this with root account.
Now, before we actually start running this tool,
I want to talk about another thing
which is called manual packet forwarding.
So sometimes some of the tools will not perform
the packet forwarding for you.
And if you don't do it yourself,
sometimes even after performing the ARP spoofing
and the man-in-the-middle attack,
your targets will not be able to visit pages,
because you didn't allow packet forwarding.
To always make sure that your packet forwarding is allowed,
you can cat out the file at
location/proc/sys/net/ipv4/ip_forward.
Once you cat this file, you will either have
a value of zero or one right here.
If you have a value of zero,
that means the packet forwarding is not enabled.
And, in that case, you must enable it first.
To do that, you can type echo 1,
and you echo it into this location.
So proc sys net ipv4 and ip underscore forward.
And then you double check to see
whether the value of one has been added to this file
and it indeed has.
Now the packets are allowed to be forwarded.
Once you do that, then you can start your tools.
So to start the Ettercap tool, all we need to do
is to type Ettercap dash G.
Oops, it says Ettercap not found.
Let's give it a try.
Maybe it is not installed by default.
Let me see.
Hmm, unable to load Ettercap.
Maybe it is lowercase.
So if I type it like this,
okay, so now it works.
Just make sure that you specify it
with lowercase e at the beginning.
Then you type ettercap and then dash capital G
for graphical interface.
Once you do that, it will open this new window
which is the new version of Ettercap,
that is a little bit different than
in the previous Cal Linux versions.
You can enlarge the window and the first thing
that we must do right here is to set up the interface
and the sniffing at startup.
So you can turn this on,
you can select your primary interface in case
you're over Cal Linux.
It'll usually be eth0,
unless you're running over wireless.
Then you want to choose a different interface.
And once you do all of that,
you can click on this check button right here.
Which says accept, and it will tell you down here
started Unified sniffing.
Now what I usually like to do,
is I like to enlarge this lower window
a little bit more to see everything better,
and then we can experiment with different Ettercap options.
The first thing that we must do,
once performing this attack, is to discover
all of the hosts on the network.
To do that, you can type on this button right here.
It'll even tell you that this button is used
to scan for hosts, and once you click on this,
it will automatically scan all 255 hosts on my network,
and it'll tell me four hosts added to the host list.
But right here we cannot really see the hosts.
So how can we see which hosts are discovered?
Well, we can go onto this button right here
click on it and it'll tell us the IP addresses
of the hosts and their Mac address.
Down here also, these buttons will open the lead host at
Target one or add to Target two.
And as in the previous video
we're going to perform this attack on our Windows
10 target machine.
Or in my case
I'm going to perform on my Windows 10 target machine.
You can choose what type machine that you want
since the IP address on my Windows 10 machine
is 192.168.1.7.
I'm going to right click on this
and add to Target one.
To check out whether I successfully added.
I can take a look down here and it does say Host
and then this IP address added to Target one
but I can also go to these three dots
click on targets and click on current targets
and it'll tell me that I have the current target
of 192.168.1.7.
Once I select my targets, I can start ARP poisoning.
And to do that, I click on this right here
which says M I T M menu, and we got different types
of poisoning, but we are interested in this ARP poisoning.
Click on that and click on, Okay, to start sniffing
remote connections.
It'll tell us down here our poisoning
victims Group one, which is the only target that we specify
with its Mac address, and the group two will be all
of the hosts in the list, but we don't have any.
So currently we are attacking just the Windows 10 machine.
Now there is one thing about this tool.
It'll not print nearly as much information
as the previous Better Gap tool.
However, once our target visits a page that sends
unencrypted usernames and passwords, it'll print that right
here and we can take a look at that
by going to our router as in the previous video
and typing in, for example, admin and then password.
If I click on login down here, we will manage to sniff that.
As we can see the htp
it'll tell us from where the the connection come from.
The username is admin and the password is this.
Now, this is once again the hashed value of the password
because that is how it is implemented inside of our router.
If it was some page that was sending the passwords
in plain text
we would be able to see it right here in plain text.
Okay, so now
that we did the same thing from the previous video,
I also want to show you a cool trick that you can check
out to see if the target machine is being arp spoofed.
So let's say that we are on our target machine
and this is the machine that is currently being ARP spoofed.
How can we check out
whether our connection is being sniffed?
Well, we can open the command prompt
and we can type the command ARP-a
and this will give us our ARP cash, or in other words
this will give us the IP addresses
of the machines in the local area network
and their correspondent Mac addresses.
And if we take a look at right here
we can see that all of these IP addresses right
here appear to have the same Mac address.
And that is not a good sign.
Once you see something like this, or if you even
see two different IP addresses having the same Mac address
that is also not a good sign
and that would most likely mean
that a man in the middle attack is being performed
especially if you have an IP address
of router having the same Mac address
as a different machine on the network.
And this is how you can check this out.
For example, if I stop this
let's go right here and quit this program
stopping the Mitm attack and closing this.
And if I go and run the same command.
Now you can see different IP addresses have
different Mac addresses, and this is how it should be
because the Mac addresses are unique.
So one IP address should have one different Mac address
and not like this where we had all
of the IP addresses having the same Mac address.
Now in the next video, we're going to take a look
at how we can perform this manually using Python three.
We're not going to be sniffing for data.
We're just going to see how we can change the Mac address
of the router from our Cal Linux machine to appear
as the same Mac address
from the Cal Linux machine to our Windows 10 machine.
Or in other words, if you didn't understand
we're going to spoof the Windows 10 machine
with one packet just to change its r tables.
And we're going to do that using Python three.
So that would be about it for the advocate tool.
You can experiment with other options as well
if you want to, and I will see you in the next video.