Hello everybody and welcome back to the man in the middle attack section.
Now before we begin using the tool that we installed in the previous tutorial I just want to show you
how you can do this manually using some already Breen's tools that come in clinics.
So what we want to do first of all if you didn't watch the theory video behind this you might want to
watch it since I want to explain why are we doing certain things right here.
But let us get right into this.
So what you need to do is first of all open up your terminal.
And since we will be running multiple commands at the same time we want to use a tool or a program that
we installed in the previous videos or I showed you how to install it.
It's called deluxe.
Now What telex is it's basically a terminal that allows you to open multiple windows and run same command
or run different commands at the same time.
So let us open telex and let us close these terminals since we donated so but don't call it an act you
basically close it on this dash right here since it will close till X as well.
And now what we want to do is we want to split this deluxe into three different windows so we can run
three commands.
Now what we want to do is we basically want to run the OPs spoofing attack against our Windows 10 machine.
Now I want to show you the command of how to change your or how to check your cache table or your arm
cache table and see which devices do you have in your ARB cache.
So just type your art minus say and you will see all of the devices that you have currently in your
ARP table and we can see the Gateway which is one idea that wants to say that one that one at this MAC
address and we can also see my Windows 10 machine which is what I two to that wants to see that one
that seeks which will be targeting at this MAC address right here.
Now if we open up my command prompt on my Windows 10 machine and we type the same command which is out
minus say we will see that it also has some machines in the ARP table and we can see that one of them
is our router at the same MAC address as we can see right here.
And this one right here which is one I to that 168 that one that date is Mike Kelly Linux machine which
has this MAC address.
Now you will see after we perform the our spoofing attack that these these two that these two IP addresses
will both have the same MAC address which will be the MAC address of our Kelly Linux machine.
That's how you will know that someone or basically us in this case is running the are spoofing since
both of these machines will have the same MAC address which will be the MAC address of our Kelly Linux
machine.
So now that I explain this let's run the commands.
So the tool that we will be using which is already in clinics is our spoof.
So just type here our spoof and you will see the usage.
It is simple.
We are basically select our interface and our target.
Now since we are only targeting one host and not all the hosts in our local network we will basically
run the same comment twice.
But with the reverse IP addresses.
Now let me show you what I mean.
First of all.
So type your absolute then minus side and then select your network interface.
In my case that is 88 so since if I type here I have config you will see that my only interface it's
connected currently to the network is the 88.
Now if you have a wireless adapter that is connected for example you can use that one as well but just
name it differently.
Or just check out the name with the F config comment.
So type here I are both minus side then 88 0 then minus 3.
And I have to do minus t we select two IP addresses which one of them will be directors IP address and
one of them will be deep into certain IP address.
So just type your one IDE to 168 that one that one which is our writers IP address which we want to
spoof and type here.
182 that 168 that one that's 6 which is the IP address.
If I check your correctly IP config which is the IP address of our windows 10 machine which we are targeting
now.
This basically means as I talked in the theory video that this will spoof both the target the routers
IP address and the Windows 10 IP address and that will make the packets go through us since the router
will think that we are the windows that machine and the Windows 10 machine will think that we are the
router so they will both be sending the packets to us which we will be forwarding to the router which
we were before we went to the other websites.
So we can't only run this command since this will only ask for one target.
We need to put them both in for this to work.
So just type your optimal minus side then 88 0 then minus 3.
And now just basically these two IP addresses that we specified in this order which is first the Reuters
IP address and then the windows then IP address you need to reverse.
So just type your one 8 to pops when I do that 168.
That one that 6 which is Windows 10 IP address and here Type 1 8 to the 168 that one that one.
Now once you do this basically just click here enter on both of these commands
and it will stop start up spoofing as we can see right here.
And this will continue as long as you run it.
Now what you want to what you want to check right now is for example it's open up now.
Our command prompt on our windows 10 machine and different type here again our minus a you will notice
that now both of these IP addresses have the same MAC address which is the MAC address of Oracle Linux
machine which means that our Windows 10 machine.
Now things that the router is at this MAC address and it sends all of its packets to the to the.
Now our car Linux machine.
And this will continue as long as we run this.
Now if you go on to the Internet and our Windows 10 machine and you try to visit a website you wont
be able to do it.
Now I am able to do it because I run a simple command before I started this which I will show you right
now.
So let us just close this for a second.
If I controlled see both of those windows you will see that it will clean up and rearming targets which
basically means that it will start sending our requests and replies which consist of true IP address
with its true MAC address.
So they everything will be back to normal.
Now you probably wouldn't be able to collect tolls go to the improperly spoofed target machine if you
didn't run this comment which is Echo 1 and then proc sis slash net slash IP before and then slash IP
underscore forward.
This basically means that for a while by default you will have zero in this file which means that you
will not be able to forward the packets in order for us to be able to forward the packets you need to
run this command first before you start the ARB spoofing.
Now I was able to connect to the internet since I already read this comment before but you wont be able
to so you need to run this command.
It will basically print or it will input one into the IP forward file and it will be able to forward
back it from now on.
So just press your enter and if we catch the same file.
So let me just copy this right here.
So copy and then paste right here and if we catch that you will see that.
Now there is one in this file so now you should be good to go.
And if you run this once again you will be able to access the Internet on the R on this port machine.
So let us do that once again.
But right now let us try to capture some packets with Drift Net now drift net if I type it.
Right here you will see it will open up a window a black window which basically I believe it will pop
up some of the thousand pictures that the target machine will visit.
While we are spoofing now in some some cases this does not work since.
Basically as I talked about not all Web sites can be targeted to the ARB spoofing and to demand in the
middle attack since some of them are HDP s over t less encryption which is not vulnerable to the decrypted
man individual attacks.
So you will not be able to read.
Basically you will not be able to read packets from the till as an encrypted website.
You will only be able to read the packets from the HDP website or the HDP s website while performing
the SSL strip on it.
So let me just see if there are any options for the help for this comment.
If I enlarge this we can see that we need or basically we need to interface.
So we need to select the interface for this command.
Now the interface will be the same interface that you're running up spoof on.
Let's see do we need anything else.
I don't think so.
So we only need to run the drift net minus side.
And then the interface.
So let's first run that.
So drift net minus side and then into each show and we can see that is opened up right here.
And while that is running well let's first since it goes to the background let me just close this and
let's run the ARB spoofing first.
So I will just go and run the same two commands that we ran before so let me just clear the screen so
it looks a little bit prettier and let's run the same two commands that we ran.
So this one are proof and then started.
First the voter and then the windows that machine.
We run that one and then go in the next terminal and we run the reverse IP addresses.
So we we run these two and now the target machine will be able to connect to the Internet even while
being our support.
And basically that the victim won't know that it is being stuffed unless they run this command in their
in their terminal or command prompt and notice that they're to say Mac addresses which can be a little
suspicious and does point out to the man in the middle attack.
But most of the people don't even know what command contains.
So you shouldn't be worried about someone actually opening this.
And you also shouldn't be running this on any network you do not own or do not have permission to do
this.
So while we run the article let us now run the drift net once again minus I 88 Joe and now let's see
if this will work on this Web site.
It might work and it might not.
If we reload it we might be able to see for example some of the pictures that it will load from the
target's machine.
So if we allow this once again you will see that it works and it does load something not all of the
pictures we can try to load it again maybe it will work.
So you just click on the Web site.
Well it managed to capture something I believe.
This is the picture from the Web site or let me just check see here it is.
It managed to load this picture right here.
As I said sometimes this will work and sometimes it just won't work.
But this is just the most simple case of running the ARB spoofing attack and performing the packet capturing
in our drift net too.
We will be covering some of the more basically more advanced things that you can do with men in the
middle.
This is just the most simple form.
We didn't even use the tool that we installed in the previous video with a little bit in the next few
videos.
And basically it will automate this entire process and we won't really be needing to run three commands
at the same time we will only need to run one command and we will be able to do all of this.
Now once again if you if the top if your target machine isn't able to connect to the Internet make sure
that there is one echoed in that IP forward file which I showed you how to do it.
So let us close this.
That would be about it for this lecture.
Now if you want to restore the arch spoofing or basically restore any mac addresses with their IP addresses
just control see both of these and your target machine and you will might be disconnected from the internet
for a brief second but nobody will notice that since it will go back to normal in just one second and
nobody will notice that you Randi are spoofing attack.
So that would be about it for this trio.
We will continue with the man in the middle attack in the next one and I hope I see you there.
By.