Hello everybody and welcome back.
And now before we continue to eat recap which is not up to the man in the middle which I'll show briefly.
Let us see what else we can do with our man in the middle framework too.
So there are a bunch of other options as well.
We will not cover all of them of course.
Well I just want to show you some of the things that you can do in order to specify your tack more detailed
or in order to perform some different type of the attack.
So what we did cover we did cover how to spell we both Arp and unless we were redirecting the DNS queries
to some other Web sites we were also performing the captive portal attacks which were we redirected
all of the websites to the captive portal which was running the vulnerable or the evil code which was
redirecting people to hook their browsers to our B framework.
We were also performing some of the HST yes attacks which was SSL strip attack but let's see what else
we can perform in this tool.
So let's see something something perhaps funny for for example here you have e replaces images with
the random one from specified directory so you can specify this for example and it will load plug in
image random miser and you need to specify after that image minus there and then the directory where
you have some images stored and it will.
For example you need for change all of the pictures on that website from your directory pictures and
everyone on the local network will be seeing the website with different pictures.
Now that is something that you can do.
For example I would show you but I don't really have.
I don't really have the the folder with pictures right here but there is another thing we can do so
for example another fighting is upside down it which loads plug in upside down turn it which flips images
of 100 degrees 180 degrees so we can try that one out since we don't need anything besides that.
Let's see what else we can add in order to make our attack better.
So let's for example add this which is this screenshot right here.
Use the amount to render an accurate screenshot of Klein's browser so let's see if this will work.
Now I use this before.
Sometimes it works and sometimes it doesn't.
Let's see if it will work now.
So what we will use is basically these two options we need to specify a screen.
And then after that interval and seconds.
So let's see how that would look like we cleared the page and we type as usual.
And my TMF by then minus I.
And then the e-trade 0 which is our network interface.
After that we specify spoof and then ARP you most likely or will be using our spoofing since you cannot
perform an email attack without it.
After that what we want to use now.
I believe it is upside down internet.
Well that could be a problem.
Let the culprit or you know what we can actually do it like this.
So we can open up another terminal and here we can go to the M.I.T. and math and then add my TMF minus
minus help.
And we will find those two plug ins.
I believe there were somewhere towards the top.
Now this is also an interesting plug in injects a javascript key logger into clients web pages.
So this is basically a key logger that will be injected into vulnerable Web pages and then you will
be able to capture keystroke.
But we will not be doing that.
Right now we will only use these two which is discrete interval and then the image randomize which is
right here or not the image randomize is the upside down.
It will flip all of the images on the current that page.
So let us start typing it.
Let me just go down here so am I.
TMF minus I eat at 0 4.
Are we all recovered all of this so Gateway wanted to do that 160 that on the one then upside down or
net and then we also specify the screen and then let me see how it goes screen.
And then after that interval so minus minus interval.
Now let's set that to 20 seconds for example.
And I believe we specified everything we need.
Now let's see the target that we will be using is our good old web site which is this one.
So if we refresh it right here it doesn't have much pictures but it does have some of them.
So as you can see right here right here this picture right here is also a picture.
And let's actually run this so it loads the default banner it loads all of the plugins.
And right now if we tried to reload this page let's see if this will work
we can see this picture right here which is in the name is flipped so let's see this one is flipped
as we can see that 2019 is flip.
This one didn't.
Now most of these as we can see this one date.
So this is the picture that flipped as well.
We could see it doesn't really work on all the pictures but some of them did flip.
Let me just see if there is anything else that flips OK.
So that would probably be about it.
Now some of them did and some of them didn't.
We can try to render the page once again maybe some of the others will flip as well but it doesn't matter.
This is just a little of some fun thing that you can do while performing the attack.
You can fool around with some people.
So nothing will slip.
This is the picture that did flip this one as well right here.
So that's a fun thing to do.
Now let's see.
Another thing that could be more useful which is this one saved screenshot to 192 that 168 that wanted
to and this is the name of the screenshot.
So let's actually see if we were really able to capture and screenshot so let's close this.
Now I'm not really sure where exactly are these pictures it could be in the logs.
So let's check right there.
And here they are.
We captured actually five different pictures.
And let's actually open some of them.
Now we will go to the folders and then we go to the root directory and then we will go to the M.I.T.
map directory and then logs and see what kind of screenshots we were able to capture.
Now let's go to the.
Let me just see
home.
We know.
Well I do not want to go right here where I want to go to the computer and then from the computer I
want to go to the root directory.
Let me just find it right here.
Then we go to the Am I TMF Right here to the logs.
And here are the pictures so we open one of them for example and we can see if it were to open so let's
see if this picture will open OK.
There it is.
We can see that we successfully managed to capture a screenshot from the target's browser so this could
be very interesting you could capture all kinds of stuff with screenshots.
As I said it will only work on HDTV websites and on Egypt CPS Web sites while performing SSL.
Now in this case we didn't perform as a cell we were attacking and HIPPA website so we can see that
we successfully captured couple of screenshots on and on each 20 seconds.
We can also see this image that were that was flipped on the target's browser.
So this attack successfully worked.
Now let me see since I don't really need this.
Let me open up terminal from here and let me delete
or I will just delete it later since it has some Twitter names.
No sense to delete right now.
And we can see that we successfully captured screenshots.
And also we successfully flipped the images on Target's browser.
Now this is not the only thing you can do with this.
Of course and this is just some fun things that you can perform.
So let's see what else we can do.
We will not be running any more attacks.
I just want to show you that there are other things you can do as well such as for example.
I believe you can run a shell shock attack with a store using this command right here.
So am I TMF Then e for the interface then.
Right now you want to what you want to use E spoof and then ops spoof and then DHS p and you can use
shellshock right here.
I believe you need to specify a command.
So for example hello and you will be able to run the shell shock attack which we covered even before
briefly.
Now shell shock as I said before the basic beat is a bug it is widely known and in the Unix special
it would scar I believe in 2014 or something like that.
It is.
It allows an attacker to cause vulnerable versions of bash to execute arbitrary commands.
So this can allow an attacker to gain unauthorized access to us to a computer system.
So that is also something you can take a look at.
You can also take a look at the key logger that I showed you before.
So there is that option as well.
And there are a bunch of other options that you can use right here.
So we will not be covering all of them be covered some of them.
Some of the more important ones and you can experiment with the others if you want to.
Now in the next video what we will be covering is ether cap tool that is the tool for man in the middle
attacking which comes pre installed in clinics.
We will cover it briefly since we cover most of the attacks in this.
Also I'll just show you about how to use the capital and what you can do with it.
And then we will continue to the next section which is system hacking section which is probably the
most important section in this course so that'll be about it for this tutorial.
I hope you enjoyed it and I hope I see you in the next one.
But.