Welcome back!
In the last lecture we took a look at Bettercap, one of the most complete and advanced Man-in-
the-Middle attack framework. Bettercap brings MITM attacks to the next level. Let’s start a MITM
attack of type ARP Poisoning using Bettercap! We’ll intercept all the traffic between Windows,
the recording machine,
it will be the victim and the default gateway! We will see all Internet data sent and received by
the victim.
The attacker who runs Kali is connected to the same WiFi network as the victim and the default gate.
Kali runs in a VM and the network is set to bridge mode. Let's start
Bettercap! bettercap -iface and the name of the interface.
eth0 . To insert in the middle of the connection
we'll use a module called arp.spoof.
Let's see the help of the module and what are the available options help arp.spoof We see that the module
is not running.
We started by executing art.spoof on and we stop it by executing arp.spoof off .There
is also the possibility to launch a denial of service attack,
not a Man in the Middle using arp.ban on. In this case bettercap will intercept the traffic
and then drop it.
We'll see shortly how to do that.
We also see the available parameters of the module, a short description of each parameter and its default
value.
There are two parameters or options that are of interest to us at this moment.
arp.spoof.fullduplex and arp.spoof.targets.
Let's take them one by one!
arp.spoof.fullduplex will make bettercap to spoof both the victim and the default gateway
if it's set to true. If it's set to false, which is the default value, it will spoof only the victim, not
the default gateway as well.
In this case we cannot inject packets and the data in the connection between the victim and default
gateway; we will talk more about injection in the next lectures.
Note that the default gateway could have some anti spoofing features like dynamic ARP inspection activated.
If it's the case we cannot spoof the router and we have to set this option to false. To change the value
of an option,
any option of any module, we execute set the name of the option and the value; for example set the option
and the value true. When you change an option you can use tab to autocomplete that option.
It's the Linux style of running commands! For example ar and I am hitting tab and it has auto completed
the option; f u and TAB OK you've got it and I want to start
also the net.probe module for it to be able to discover the targets: so net.probe.
The second important option of arp.spoof module is arp.
spoof.targets; it's used to specified the host targets as a list of comma separated values
of IP or MAC addresses. Let's set the target as being the Windows machine.
Let's see what is its address: ipconfig and this is
its address 192.168.0.113 so set arp.spoof.target and the
IP address of Windows
Now that we've set all the required options
we can start the module arp.spoof on
arp.spoofer started and there is one target; there is no error in I'll check that the module
is running by executing help and we notice that besides the modules that were running arp.spoof
is also running. Take notice thatnet.probe and net.recon must be running as well.
Let's check that the attack has been executed successfully.
Let's see the MAC address of the attacker. In another terminal
I am executing ifconfig and this is the MAC address of the attacker.
It ends in 76 and on the victim machine let's display its arp table: arp - a
And we notice that both the default gateway and the attacker have the same MAC address in arp table.
Now when it wants to send the packet to the default gateway or to another address on the Internet it
will search for the MAC address of the default gateway of the arp table and use that address.
This is the default gateway and this is the entry for the attacker.
The attack is running! The information like emails, credentials, like usernames and passwords or other
sensitive data will be intercepted by the hacker who is in the middle of the connection between the
victim and the default gateway which is also the access point of this network. To save and see the
capture packets
we should use a program like Wireshark or we can start a bettercap module that does the job; and the
bettercap module that sniffs and then displays sensitive data is net.sniff and we must start
it as well: net.sniff on.
Okay, let's test the attack! From the victim's machine
I'm gonna visit a website and then log in and the site is demo.testfire.net. I'm clicking
on
online banking log in, user name Andrei and the password
test 1234 and log in. The authentication was not successful but that's not important.
Back to the attacker's machine
we notice in bettercap window the communication between the victim and that website.
This is the communication. The website I have visited and here we notice the credentials: the username
and the password.
Of course that connection was not encrypted.
It used http instead of https. We'll see in the next lectures
what are the possibilities
a hacker has to bypass the encryption and sniff encrypted traffic.
If we want to be more verbose, so to display all of the information that was captured, we set an option
to net.sniff: net.
sniff.verbose true
and we see each packet. At the end of this lecture
I want to tell you a troubleshooting tip: if you don't see the credentials, the user name and the password
in bettercap window,
it doesn't mean that it didn't capture them. Bettercap does not display all captured data but only a
part of it.
Normally net.sniff module should capture and then display the credentials for well-known protocols
like http
but from my experience I can tell you that's not always the case.
First I'll set this option to false. What you can do is to set an option of net.sniff module
to save all captured data to a pcap zip file that can be later opened in Wireshark. Let's
see the options of net.sniff module: help net.sniff
and this is the option so a set net.sniff.output ad a file
for example /root/win.pcap Bettercap will save to that file all the captured traffic
and you can later open it using Wireshark and search for traffic of your interest like credentials. And
to stop the spoofing attack arp.spoof off. It's restoring the arp cache!