Hi and welcome back to Section 11 sniffing traffic.
In this video we are going to cover how to perform a man in using
Car Lenox. So let's
man in the intention of this type of attack is to simply intercept
any sort of network traffic between two or more host devices to capture
any sensitive or confidential data that might be transmitted over in network
channel. Sensitive data might be usernames, passwords,
or any other details or let's say data that could be used to gain a
foothold into a system. In this exercise,
we'll take a look at actually using Carly Lenox to perform a man in the
between two host devices.
If you recall on our network topology that we have built,
we have the pen test network,
and on the pen test network there are two host devices.
There's the tree virtual machine,
as you can see its running and also there's the Meta two virtual machine,
which is also in state and machine willox.
So what we're going to do is we will capture,
well intercept the communication between Meta Exploitable three Windows virtual
machine and the Meta two Windows virtual machine.
So please ensure up these three virtual machines are all running simultaneously.
If you could, if for some reason you are unable to run this virtual machine,
you can simply reduce the amount of base memory or ram that is uh,
located to these virtual machines.
Once you're ready and these machines are powered on,
simply click on a Carly Lenox icon,
which is on a top left hand corner like so.
Then we'll select sniffing and spoofing.
Currently within this category there is a lot of tools that we can use,
but we're going to use a simple tool to help us perform our interception,
which is graphical.
Simply select graphical like so.
And now it is prompting us to enter our route password for
Carly.
Simply enter your Carly Lennox's user password and click on Authentic.
Once you click on authenticate. As you can see,
this is user interface. By default,
it is set to sniff at startup, however,
the primary interface it is set to E H zero.
If we use a dropdown menu, we can see there's a number of different interfaces,
so which is a right interface to sniff on our pen test network between our two
systems,
let's open our terminal so we can use if config
command, like soup hand hit enter.
Firstly we can see that E one is connected to our pan test
network simply because a Pan test network, it's
T1 slash four network. So great, we want traffic
on E one, simply close to and now on et.
Use a dropdown option and change a primary adapter to e H one.
When you're ready, simply click this icon,
which is accept and let us sniffen begin. So in our scenario,
we have two target machines on our network and is running on ethic,
but uh, is it detecting any traffic? Well,
currently since we are in a lab network,
there's no traffic really being sent across between the two target
machines. So what we can do,
we can simply click this magnifying glass to scan all host
devices on current subnet.
Simply click it and as you can see it is scanning the entire network mask and it
shows here that three host devices are discovered. To view these host devices,
simply click on this icon that says Host List and here we can see
the different machines that were detected.
We know that 2K one one is our DH CCP
server. However,
our targets are the 37 and 2d.
Simply select the first Target like so, and then click on R two, target one,
click next, select 38, which is our second target,
and click on Target two. Excellent. So now that we set our target,
are we intercepting traffic between these systems? Well, technically yes.
We are just no traffic is actually running,
but let's take a look at some additional features and at,
while these targets are selected,
if we click on these three dots icon like Sue, which is a menu,
we can click on targets and we can select individual targets.
We can select protocols. We can even remove these targets from our target list.
If I click on current targets,
we can see what my Target one is and what my Target two is,
and we can add multiple target. So for instance,
devices on Target one such as the 37,
the traffic will be intercepted between Target one and Target two. Next,
if we click on Host Devices, we can see our host lists.
We can enable IP V6 scanning. If we're connected to an IP V6 network,
we can even scan the new host.
We can load Host from a previous file that we have saved.
We can even see the host file that was generated onca.
Next we can click on view. View will show statistics.
It can help us resolve IV addresses, provide visualization,
but most importantly we can see the connections happening.
Let's click on Connections current.
Currently there are no connections appearing, so let's generate some traffic.
I'm going to open Metas Exploitable Tree like so, and I'm going to log,
I'm going to select the administrator account and use a password as
V H G R A N T and simply enter
on this virtual machine.
I'm simply going to open the command prompt and identify the IP address of
this device.
I'm going to use a IP conf command and currently this device it is
1 7 2 2.
This means four is the other target machine,
which is meta exploitable to therefore I'm going to minimize this and
I'm going to open a web browser within Meta Exploitable Tree Windows virtual
machine on the web browser,
I'm going to enter each TTP pull on slash slash
1 72 7,
which is a IP address of the Meta Exploitable two virtual machine.
Simply enter and notice the web page of Meta two has loaded,
but also notice on a connection generated.
Here we can see the connection. Well,
the source IP address is 1 7 2 t2,
which is tree. There's a source port,
there's a target system or the destination IP of 1 7 2 T
seven, the destination port of 80,
which indicates that it is using HT dp, the protocol as tcp.
The current state of the connection is active, the transmitting bys,
the receiving bys, and the country. To get more details on this connection,
we can simply right click on the connection and select view details.
Here we can even get the source and destination IP addresses,
source on destination market addresses,
and we can even try to re their geolocation.
So now that you have learned how to perform a Man intercept traffic
using Over, keep in mind that while you are intercepting traffic,
you can simply open wire like so.
And once you have open wire Shark,
simply select the interface to capture traffic on, which is E one.
Currently we can see that no traffic is being captured within wire.
So let's head back to my machine and this time I'm
going to refresh the webpage and notice that the connection has
appeared within tica and the traffic has also appeared within Wire Shark.
So great. We are using two different tools. One to perform a man in the middle,
and another tool which is Wire Shark to actually capture the packets between
these systems. To save this pocket capture, simply click on the stop button,
like so. Click on file, click on save,
and let's save this as capture one and
select Save. So once you have capture traffic,
you can perform your pocket analysis afterwards.
During the course of this video,
you have learned how to use Ether to intercept network traffic between two
host devices only network. In the next video,
you'll learn how to use Wire to perform analysis.
I hope this video has been informative for you and I'll see you in the next one.