Now will demonstrate an AARP cache poisoning attack which is a widely available program called Cain
and Abel which has many additional functions but can be used for poisoning
before we start using the program.
Let's examine the victims AARP cash in order to see the contents of the ARP cache.
You just have to type in art with the parameter a into the command line as you can see the cash now
stores only one IP and one Mac were lied to victim to notice so that you can see how such an attack
unfolds
under the sniffer tab you can see the information about who's currently connected to the network.
A couple of computers were found.
We can see their names.
We can learn that the victim's computer runs on Windows XP and that the IP ends in 1 1 5.
Let's check again the contents of the ARP cache of the victim besides the address ending in one which
is probably the default gateway.
We see another IP ending in one to five and a MAC address ending in 42.
It all pertains to the computer we will use to conduct the attack.
For now this is all we should remember.
Back in the Cain and Abel program which was the ark tab and we add the computer whose ARP cache we want
to poison
we'd like to do it in such a way that enables us to intercept packets sent to the default gateway which
we will then forward to the router.
And vice versa if the rudder tries to communicate with the victim's computer it will send the packets
to us and we'll forward them will be the men in the middle.
We start the program and return to the victim.
Let's read the Arcachon once more to see what happened.
The Mac ending in 42 is now associated with both IP addresses victims computer trees the attackers computer
as the default gateway.
It will send all the data to it.
Let's try to send some data
will connect to a certain server
we're required to type in the username and password.
We'll use test as the username and pass has the password
this data is incorrect so we didn't manage to establish a connection
we can try connecting to a local network host and to open a website
everything works just fine.
We browse the Internet.
We could probably connect with a favorite banks logon page when we try to connect to a website through
the secure HTP protocol.
It turns out that the site certificat created some problems
likely the certificate was issued by a company you have not chosen to trust.
After closer examination the certificate seems valid
it cannot be however verified.
We had a chance to see that things look normal from the perspective of the target computer.
It can still establish connections with web pages with the FTB server and with the network share items
let's see how things look from the attackers perspective.
As we can see some packets were indeed routed.
We also intercepted a lot of data can enable has an additional function you can export the data directly
to the passwords tab
will find their passwords grouped in the categories above you can see the NZL and passwords which we'll
talk about later.
By right clicking on the password you can choose the option to send to Kracker having the passwords.
We can find a Windows local network user's password and just a few minutes this password would allow
us to connect to the file server the FTB server passwords are stored in plain text.
If the HTP passwords are sent as plain text they'll be stored in that form as well.
Let's start the victim's ARP cache poisoning.
We have to do that to prevent the victim's computer from discovering our real mac address.
The information we discussed before and the demonstration you've just watch should help you conduct
your own Arbre cache poisoning attack using the Cain and Abel program which I strongly encourage you
to do.
You can try to use a newer web browser.
For example the new Internet Explorer to connect to an HD secure Web site.
It can be a bank's website or email web page.
The web browser here doesn't really matter because the attack is conducted on a very low layer of the
OS model and the web browser trusted is sent from the lower layers.
Whatever browser you use you should get an untrusted certificate error message.
In reality we don't connect directly to a web site but rather to the men in the middle computer reconnected
their attackers computer who sends the data forward.
The certificate is issued for a specific computer and won't be compatible with the man in the middle
computer doing the exercise.
You should ignore the untrusted certificate error message.
It will allow you to connect to a Web site in the HTP secure forum you can type a log in and password.
It will later be visible in the Cain and Abel program.
There will be no need to decrypt them and it's not an encryption issue.
The password will be visible because the victim has sent it to the attacker voluntarily the untrusted
certificate error message was triggered by the certificate issued by the Cain and Abel program for this
particular session.
In this way the program enables you to connect to the HTP secure Web site.
It turns out that the victim encrypts the data with the attackers encryption key the attacker decrypted
them easily next to the attacker encrypted them again with the Web site's encryption key and sent them
forward.