Hello everybody and welcome to the next tutorial in the man in the middle attack.
So now let the state run some of the more more advanced tech with the men in the middle of prep work.
So in order to do that let's see our available options first.
So just type your dot minus dot slash minus or dot slash M.I.T. MF dot by minus minus help.
Sorry for that and let us see some of our available options that we can use right here.
So if you scroll up you can see a bunch of these options.
Now we will mostly be using the minus minus ARB spoofing.
We will use later on the DNS spoofing or possibly in this video as well.
What we want to do I just want to show you that you can also specify targets with this.
So not everyone on the on the local network will be exposed to the ARB spoofing attack.
So if you just specify both the gateway and both the targets or our single target it can be used to
only attack one single machine.
Everyone else will be functioning normally but be aware that sometimes when you close this program everyone
will be unavailable to connect to the internet because you were messing around with the ARP table in
both Gateway and both your machines that you were spoofing.
So it might take a few seconds possibly a minute or two in order for everything to get back to normal.
And in order for everyone to be able to access the internet once again.
So let's actually specify a single target right here.
We can do that with my TMF minus minus or minus AI for the interface we specify the EDI h zero as one
for the interface and we specify the same as before so minus minus both then minus minus ARP.
So for our stalking and then minus minus target we can use our command prompt to check out the IP address
of our we understand machine.
So it is one I do that want to say that one that too and then we specify that IP address right here
and then we specify the gateway IP address right after it.
So one that one and I will not be running this command at the moment is it is the same as in the previous
video.
I just want to show you that you can specify a single target or I believe if you for example do something
like this to minus 20.
It will ARP spoof all of the targets that have the IP range between dot one the two and between dot
one the 20 so it's good to know that you can do that as well.
And right now before we continue I want to show you the config file that comes with the MF.
So what we want to do right now is I want to show you how you can perform the same attack on the AC
ATP as servers or Web sites as well.
So we saw in the previous video that this Web site right here which is HDP s wasn't vulnerable to our
our spoofing attack and we weren't able to see the username and password that were typed in on this
Web site.
But let's see if we can change that.
So we want to run this command.
Let me just play this and what you want to do.
Let me just first clear the screen.
Just type LSU in the M.I.T. MF folder and you will see a directory called config.
It is right here.
So let's change our current directory into the config directory and what we want to do is type your
l s and you will see that there is a file called MTM that don't count.
Now you will be using that file extensively while performing some of the advanced attacks right here
in this tool.
Since all the configuration is in that file.
So right now what we want to do is basically we want to we want to open that file so let us nano Am
I TMF dot com and you will see some of the available options right here.
So this the configuration file as it says right here everything that is after the hash is referred to
as a comment and it won't be run by our man in the middle or proxy.
So this is for if matters employed.
AM My TMF API users so we can see some specified host port.
Now this is the the default port would it be for access as framework which we were also covering the
next videos briefly while performing demand in the middle attack the methods ploy to covering the next
section.
But what we are interested right now is the DNS part right here.
So you have a plugin called DNS in our man Domino framework 2 which can allow us to basically specify
the IP address for a certain domain as we can see right here.
Twitter dot com equals 180 to that 168 that won that 15.
Now we both know that this isn't the real Twitter's IP address and it basically will redirect the Twitter
dot com to the one to that once you say that one that 15 which is my laptop's IP address.
So for example I could be hosting a fake log in page on D on my laptop and I could be redirecting everyone
to the laptop and the people wouldn't even notice.
Since if I host a fake Twitter log in page everyone will think it's legit since they typed in the Google
search bar.
Twitter dot com and they were redirected to Twitter.
Dot com log in page but it is a fake one.
So let us actually try to use this but not on Twitter since I don't believe it will work since Twitter
is h t p s or t less now sometimes I were able to get Twitter to display a fake log in page but not
with this attack with the H HST s attack which is basically stripping the SSL and performing the DNS
resolving on Twitter which basically just enabled us to be able to capture username usernames and passwords
on Twitter as well but this doesn't work anymore I believe.
So we will specify a simple website like this one which is a GDP s so we can see that its domain is
this one we will specified right here.
So let me just type here star then dot then this right here and we can specify the IP address of my
laptop since right there I am running Apache to.
Now if you are running a patch two and clinics what you want to do is basically open a new window let
me enlarge this right here now your Apache two web page folder is stored in seed so strange rectory
bar W W W and H PML.
So if you type here unless you will have probably this index that a CML file which is the file that
you will display once someone types your IP address on the Google search bar.
So let me just delete this file right here and let me get the in the rotation the amount so let me just
show you what I mean by that.
So let me just check my IP address.
My IP address is not one not seven.
Now if you open up your Firefox and type the IP address of your calendar machine it will lead you to
your Apache to web page if it is running currently.
If it is not I will show you how you can run it not one 7.
Not really sure why is it displaying.
Oh ASP
as we can see is not one but seven.
Even my IP address so let's call up.
It is my IP address but it doesn't seem to be loading the correct page.
So let's remove the or Let's rename the index that is the amount into one that came out.
So this will display the page a little bit different since a patch it to only recognizes the the unable
to connect Firefox can establish a connection.
The site could be temporarily OK.
It doesn't even matter but you want to do is basically take a fake page or any other page and put it
in this folder and name the main h the email file indexed HDMI out.
So in order for the Apache tool to display your fake page properly you will need to name the file indexed
top HDMI out if you name it.
For example one that HDMI out.
This won't work.
So keep that in mind.
I will show you once we create a fake captive portal I will show you how you can clone pages and how
you can put them in the Apache too and run them for example.
You can see that my Apache too is running on my laptop.
If I type the IP address on my laptop you will see it will lead me to this index off and then some files
right here.
So these are basically some of the files that I have in the slash bar slash W WW Slash is the amount
folder and they will be displayed on the page.
Once you type the IP address.
Now the point of this is that you can have a fake log in page displayed right here and you can redirect
this website to that fake log in page so every time someone types this in their search bar they will
be redirected here.
Now let us see how that works right now.
So let us call this first of all what you want to do is control or to save enter and then control X
to exit.
And let me just turn on the Apache too on my laptop.
OK so it's already turned on and what we want to do right now is run this command.
So am I TMF Does this help in order for us to.
Oh it's a mighty amount of call.
We do not want that.
We want to go on directory back and right here on M.I.T. a map that does help and let's see what we
can do in order to use DNS to 40 redirection.
So if we can see right here uh let me just find this perfect part since I believe it is right there.
Did they pass it
where is it.
Where is.
Okay here it is minus minus DNS.
So proxy modified DNS queries.
That's what I was talking about.
So we will use this one for anyone that specifies the certain name of a website that we specify in the
conflict.
While they will get redirected to my laptop which is running a patch it 2 on the IP address 1 92 that
168 that one that's 15.
Now what you also want to do a if you want to perform the SSL strip is you can run this command right
here which is minus minus H S the s.
Let me just find it.
Where is it.
Right here.
It's not here.
It's not they're not just fine it.
They're just bunch of options right here.
It is not so easy to keep track of all of them.
It should be somewhere right here.
Here it is.
So as a cell strip HST Yes loads plug in SSL strip enables us so strip for partial HST yes bypass.
So let us perform that and we will run the full command which looks something like this.
So dot slash and my TMF dot pi minus IV.
And then we specify our interface which is 88 0 minus minus both.
And then what we want to specify right here is we want to specify the both Arp and DNS spoofing.
So we step specify DNS so we can use the thing we specified in the conflict file and we use the minus
minus ARP in order to perform the ARB spoofing as well.
Right now what we want to type after this is the gateway.
So let's say the Gateway.
We will not specify these targets since we want to actually our spoof everyone on the local network.
And after that the only thing when you specify again or not again for the first time is h as the S S
H S T S which will load the plug in for SSL strip which will enable us to capture the information from
some HDP s Web sites.
So once you type this comment right here and just press here enter it will once again load the banner
and it will start our ARB spoofing attack as we can see the SSL strip is loaded and both our DNS spoofing
and our spoofing is enabled.
So let's see now what happens when we go so let's just close.
So let's see what happens when we try to visit the domain
that we specified in the in the dot config file.
So if we I if I press here enter you will see that it doesn't even lead us to that web page.
It actually does to my laptop web page.
See I typed here this domain and I was redirected to the same IP address on my laptop as we can see
these two pages are basically the same.
So this my IP address or laptop and this is the domain that we visited before with the log in page.
As we can see the redirection work that worked perfectly.
And now if I had a fake Web page right here which looked the same as the real domain I would get redirected
and nobody would notice that they are currently on the fake page since it says the same domain name
right here.
And the page would look identical if we check it right here we can see that the DNS cooking the response
of Taipei.
Now this single a basically means for IP for mac address IP address for this website which we specified
in the contract while to this IP address.
So it performed the redirection using DNS spoofing.
Now if you wanted to go for example to the logon page that we went before check it right here.
So this is the Web page right here.
You can see that it is still HDTV s for some reason.
Now I'm not really sure why is that.
So let us try to run this once again without the redirection.
So let's close this for a second.
So we successfully managed to redirect the person but now we want to capture the the user name and password
from that age at CBS Web site.
So let us remote First the redirection that we just find.
Where is it.
OK.
So here it is.
We do not want this.
So I will just leave it on Twitter.
Dot com IT DOESN'T EVEN MATTER IT WON'T REDIRECT THE Twitter and if you go down here you will find the
SSL strip plugin or the configuration for the SSL strip.
Now what we want to do right here is basically if you want if you have a Web site that you want to perform
a cell strip on here as it says here you can configure your domains to bypass HST yes on the format
is real domain dot com equals fake domain dot com.
Now basically for anyone typing for example Facebook dot com they will get redirected to walk in dot
Facebook dot com which will be a log in page that you would be able to sniff the user name and password
from.
Now what we want to do right here.
Let me just close this for a second and let me see if I can bring my router since sometimes I get disconnected
from the Internet while performing the attack.
OK so everything is good and let's perform the same attack.
So my A.I. or interface 88 0 minus minus spoof and minus minus DNS minus minus.
We want to specify the Gateway as well.
One wanted to the considered on the one.
And we specify HST.
Yes.
And let us run this once again.
OK.
So you can specify the minus minus interface letters is it with minus I.
And let's run this attack couldn't listen on board that resulted in years.
OK.
So this means basically that we need to restart this terminal.
Since the address is already in use we can actually use this one.
We need to just go to the vault and then add my TMF And now we want to run the same comment.
So minus I 88 zero.
Now when you get that address all renewals just restart your terminal and it should be good to go.
So I just used the different terminal set since I already had it open so let's specify the same command
and let's run the attack once again.
So Gateway one I do that one say that on the one and then HST yes for the South Street bypass.
Now I think that's it.
And let's let this run everything is good.
If we go right here and with Pat and we visit this for example we can see a simple edge DP websites
could not proxy requests timed out.
Okay so my internet seems to be down.
I will have to restart it and give me just one second I will be back.
Okay so I'm back on the internet and let me just restart the terminal and then continue.
But in light of this we just want to see if the SSL strip attack will work.
Let's first change our directory to the man in the mental framework and let's run this attack the same
as before.
So right now we can see everything is order DSL strip.
And if we visit this page which we couldn't predict before we get it specified right here.
OK.
So we can see that we are visiting the page.
But what happens when we visit that page that we visited before which was a GDP s.
Let me just change.
No I did not.
On that page.
So we want right here and we specified that right here we are still getting redirected for some reason
can't really seem to figure out why is that
DNS cooking.
The response of Taipei for the Web site.
So we are still getting redirected.
Why are we getting redirected.
I have no idea.
But let's try some other page which is Sam's Club.
Now this page is usually the HDP page and we can see that the SSL strip worked for this page.
Now I'm not really sure why it didn't work for that uh for that uh address TPM page.
I believe it has something to do with the previous tags that we ran.
But if you notice for example if you visit the Sam's Club dot com page on your own you will see that
it is HDP s.
But right now we are able to capture all of the packets going through this page.
And if you notice if you really notice you will see something fishy about this page right here as it
has for WS instead of three.
Now we know for my world wide world wide web has three W's and here in the link we can see for now that
is the only thing that this person can actually notice if they are running this page on the r spoofed
attack since it can be literally the same domain as in the real page it has to be some spoofed domain
and they spoofed it with four Ws.
Now it is hard to notice but if you know where to look you will notice it easily.
So now basically anywhere you go you will be able to.
For example let's see if there is a log in right here not a member join now.
So you can go to the sign in right here.
I believe this will lead us to.
Yeah okay.
So this will lead us to the log in page.
And if you specify anything right here and just specify password and click sign in you can see or you
should see that we received something there is just too much stuff going on right here.
Post data we just see if I can find it it should be somewhere around here.
There is just too much data for us to find
with this try once again.
So
if we post it once again please enter a valid address.
So I just typed Windows Mail dot com.
So we can just type any mac address or any address we have right here and let me just see if it captured
anything.
Resolving resolving
here it is.
So the user name windows at gmail dot com and let me see where is the password.
I'm not even sure what I typed as the password so that could be a problem in this huge uh.
So password.
There is something password.
Password.
Here it is.
So value for the password is this one.
Now it could be a really really hard to find sometimes but we managed to find it.
So this is a password that I typed in I just typed a bunch of random letters and they were able to successfully
get the logging of username and password for the HDP S. PAGE while performing the ATP as or SSL strip
attack.
So that's how you can actually gather the user name and password from some websites that are not HDP.
Uh while performing the SSL strip.
Now this one for on all the websites.
Uh.
As I said on the TLC websites it shouldn't work as a sales rep shouldn't work on TLC website but as
I said before I sometimes was able to get it working on Twitter dot com and I could capture Twitter
dot com credentials so that would be about it for this trial.
It was rather a long tutorial in the next one will will cover some of the plugin or we will combine
two tools which is this tool and the tool called Beef.
I will show you how you can hook other browsers and try to exploit the victim machines on local network
using man in the middle attack.
So that would be about it for this tutorial.
Remote place you in the next one by.