‫Oh, yes, there's plenty more to do.
‫There are several tools to perform an AAP spoof attack, such as AAP Spoof, the command line tool,
‫which is embedded in Cali, but we're going to use ED Cap for the demonstration of the AAP spoof attack.
‫Ed Capp is a free and open source network security tool for men in the middle attacks on land.
‫It works by putting the network interface into promiscuous mode and by art poisoning the target machines,
‫thereby it can act as a man in the middle and unleash various attacks on the victims.
‫Better Cap has both a command line interface version and a graphical user interface version.
‫Let's see him both in action.
‫First, let me show you the command line version of AerCap.
‫So this is my network created in Janus three.
‫I have a collie and a wasp and a Metasploit VM in the network.
‫To use if config inside the VMS to check the IP addresses and the other interface configurations as
‫well.
‫So ping each other to be sure that they can communicate.
‫OK.
‫Now I go to Cali over an internal screen and do the same here.
‫Check the interface configuration and paying other VMS.
‫Yep, everything's OK.
‫So let's look at the art table of Metasploit, one Type R RN and press enter.
‫So currently, there are two records in the ARP table of Metasploit, but one for Collie and one for
‫oash BW.
‫Now, let me show you something.
‫If you want to perform an AAP spoof attack, you should enable IP forwarding in your attacker system
‫so that the packets will not end on your attacker system and be forwarded to the destination system.
‫Otherwise, you'll block the traffic between the victim and the spoofed system.
‫Check that out.
‫So the IP address is managed by a variable IP forward like in Collie.
‫And to look at the file content type.
‫Cat slash pro C slash six slash net slash IPV four slash IP forward and press enter.
‫Its value is zero, so to enable it, it has to be one.
‫So I'll change it.
‫You can open a file with a text editor and change the value.
‫But here I'll just simply use the Echo Command for this purpose.
‫Echo one.
‫Greater than sign the entire file name.
‫So check the file again.
‫And yes, its value is now one.
‫Now, please note that Ed Cap enables IP forwarding automatically, even though you don't enable it
‫manually.
‫All right.
‫I want you to know what's happening behind the scenes, so to speak.
‫All right, so now is it time the attack before creating the command?
‫Let's see the manual of etiquette.
‫So type man etiquette and press enter.
‫So here's the short definition and the long description targets.
‫Options.
‫M for men in the middle.
‫MIT them attack.
‫So these are the MIT em attack types.
‫AAB is it the first line and the others ICMP, the HP, et cetera.
‫And here are the user interface options T for the text only interface.
‫Anyway, let's just create the command.
‫So first, the command itself at Cap I, the interface is zero T for the text only interface type.
‫M, to make it a Mitt M attack and select them Mitt M attack type AAP column remote.
‫So the first IP specifies the IP address, which will be spoofed, and the second IP address is the
‫victim's system.
‫So that means there will be a row in the Metasploit BBLs Arp table with a Mac address and OWASP BW was
‫IP address.
‫And that means when Metasploit Obel wants to send a packet to always W-A, it will be sent to Collee
‫instead.
‫Right?
‫And with the help of IP forwarding, the packet will arrive at OWASP CWA finally.
‫Now, please don't forget to use these slashes at the beginning and end of each IP address.
‫The command is ready to run.
‫So let's see what it does.
‫Hit Enter.
‫And here is a summary of the attack.
‫The victims.
‫Interface type, etc. Now we'll go to Metasploit on Arp RN to see the ARP table again.
‫And as you can see here, the first record is for Carl.
‫So please look at the Mac address and the second record is for OWASP BWC.
‫But with the attackers Mac address, any packet sent from Metasploit about to OWASP CWA will visit Collee
‫now.
‫So let's create a Telnet connection to Port 80 of OWASP BWI.
‫Type Telnet, OWASP, BWR, IP and the Port 80 now hit enter tape, get slash http slash 1.0 and press
‫enter twice.
‫And here is the HTTP response.
‫The main page of OWASP bw a.
‫Now, let's go back to Carly and see what happens.
‫So these are all that TCP packet sent for Metasploit to what was BW Air Act packet fin packet and scroll
‫up a bit and here's a Telnet connection results HTP response.
‫Keep going up.
‫We can find some other critical data here to.
‫And here are some credentials, for example.
‫In the terminal screen, where Ed Cap is running, you can use control seed and the attack.
‫So there it is.
‫It's stopped.
‫Now, go back to Metasploit, Bill and look at the ARP table again.
‫Now, the IP address of OWASP, BBWAA is matched with a correct Mac address.
‫Now, you might remember what I told you before that.
‫Well, I hope you remember everything that I told you before.
‫But in particular, Ed Cap has a graphical user interface as well.
‫So let's have a look at ed caps gooey right now.
‫Again, we're in Cali click show applications, menu item and type better cap.
‫And here you go, you'll find the AerCap Gooey app.
‫So these are both AerCap gooey.
‫You can just simply click one of them.
‫I want to show you, though, another way to start the app from the upper left corner.
‫Applications go to sniffing spoofing tools and select AerCap Gooey.
‫OK, so here we are at the main panel of the outer cap, gooey.
‫We'd better check the network, so I'll open up a terminal screen and ping the other teams Metasploit
‫Bill and OWASP BW A.
‫Yeah, everything looks OK.
‫So go to the sniff menu and enter cap and select unified sniffing.
‫Asking for input interface, E0 was good.
‫Click OK.
‫If you look at the AerCap menu, it's totally different now.
‫To go to hosts and select scan for hosts.
‫It's a kind of a ping scan to find out the devices of the network found five devices and added them
‫to the host's list.
‫So go back to hosts again and now select hosts lists.
‫And here's a list very nice.
‫Works well.
‫One nine two one six eight one zero one one is OWASP BW, yeah, so this is the system that will spoof.
‫So select it and click Add to Target to.
‫So one nine two two one six eight one zero one two is Metasploit.
‫That's our victim.
‫So we'll change its Arp table.
‫Select it and click Add to Target one.
‫I think now we're ready to attack, what do you think?
‫All right, so let's go to Mitt M and quick Arp poisoning.
‫OK, check this sniff remote connections option and click OK.
‫And the final step go to start and select start sniffing.
‫So the attack has begun.
‫Well, let's go to Metasploit, Obel and see the attack result to see the ARP table type Arp in and
‫press enter.
‫The first row is for OWASP BW, but the Mac address is Carly's Mac to show it.
‫Now I'll ping Carly to create the AAP record.
‫Run the ARB command again.
‫And now I have another row for Kali and both Kali and OWASP BWR of the same Mac address.
‫OK.
‫You know, the rest, the package will be sent to Cali instead of always BWI, so if you like, you
‫can open Wireshark and collect the fruits of your labor.
‫Enjoy it.