In the previous lectures we learned how to use better cup to discover all clients on the same network
run an AARP spoofing attack to intercept the data and then sniff data to see the user names passwords
and everything that's getting sent over the network.
Now in order to do this we actually had to run a number of commands.
So first of all we had to do net dot probe on to turn on the probe module.
We had to set the settings for the AARP spoof module turned that on and then turned the sniffing module
on.
Now every time you want to do this every time you want to intercept data and see it on screen you're
going to have to do all of the steps that I showed you in the previous lecture or if you're lazy like
myself you can use a couplet to do all of that automatically.
Which is exactly what I want to show you in this lecture.
So what do I mean by a couplet.
Well basically a couplet is just a text file that contains all of the commands that you want to run.
So I'm going to resize this menu.
I'm going to open a text file and I'm just going to organize this a little bit to make it easier to
follow.
And I'm going to clear this window here and I'm gonna go to the first command that we had to run in
order to do this.
So against crawling up the first thing we did was net that probe on.
So in my text file here I'm gonna literally type this command net dot probe on and as we saw this will
automatically start the net the tree cone module.
Again we enabled both of these modules in order to discover the connected clients and keep automatically
discovering any new clients that connect to the network.
The next thing that we did was modify the settings for the AARP spoof module.
So we did said AARP spoof full duplex to true.
I'm going to actually copy this and paste it here.
Then we set the target IP.
So again I'm just going to copy this and paste it here and keep in mind this is very important.
You want to make sure that you change the IP here to the IP of your target all the time.
And if you are targeting multiple computers you can just use the comma and type the next IP after the
comma.
Next we turned on the AARP spoof module.
So again this is what I'm going to do here.
I'm going to do AARP that spoof on and finally we also run the sniffer by doing net dogs sniff on.
So again I'm just going to type this in here.
Net Dot's native on.
So this is actually a nice summary of what we did in the previous lectures.
Again like I said every time you want to intercept the connections you're going to have to start better
cap and run all of these commands manually.
You want to start the probe module you want to enable the full duplex so you fool or spoof the target
on the router.
You want to set your target IP and you want to turn on this poof and turn on the sniff.
So to make this very easy instead of having to type this every time we want to run an AARP spoofing
attack and intercept data.
I put all of this in a text file.
I'm going to save this text file I'm going to put it in my root directory and I'm going to call it spoof
dot see a p that cap so I'm going to save this now and I can close it because we're done with it and
we can go back here and what I'm actually going to do.
I'm going to exit out of this.
I'm going to quit buttercup and I'm going to clear the screen and if I do ls to list all of the files
and directories and the current working directory because right now I am in route.
So if I do Ellis you can see we have a new file called spoof dot cup.
And just to confirm if I go down to my file manager right here you can see we have a new file again
in the root called spoof dot Cup and all we want to do is feed this pool file to better cap before we
start.
Better.
Now we don't know how to do this.
So we're going to do better.
Cab dash dash help to see all of the options that we can set with better cap and what we want to do
is use the dash Capulet option right here so we're gonna run better cup like we used to do first of
all we do better cup followed by a face to specify the interface that is connected to the target network
and in my case this is 88 0.
So so far this is identical to what I've been doing in the previous lectures.
The only difference now is we're going to use the dash Capulet option to specify my couplet file that
I just created.
So I'm gonna do that couplet followed by the file that I just created which is called spoof the cup
and that's it.
Now before I hit enter just to confirm to you I'm gonna go back to my windows machine and I'm gonna
do a R P A just to show you.
And as you can see right now the rafters IP right here has this MAC address.
So after I run this it should automatically start all of the modules that I just typed and it should
run an ERP spoofing attack.
Therefore the Raptors MAC address should change to the MAC address of 88 zero that is connected to Carly
right here.
So I'm going to hit enter and as you can see we actually got an error and the error saying the couplets
poof could not be found.
So I'm suspecting I made a spelling mistake and I did.
As you can see I actually named the couplet spoof not spoof.
So I actually make a lot of mistakes like this.
So I'm just going to rename this to spoof and we're going to go back here.
I'm going to exit and run the same command again and perfect as you can see we got no errors at all.
If I do help as you can see automatically we have this poof is running.
We have the probe the recon and this NIF all running as soon as we run Buttercup.
If you remember the first time we ran it it was we only had the stream running and we had to do everything
manually and set the options manually.
So this is a really really nice way of doing it.
Now let's confirm that everything is working as expected.
So I'm going to go to the Windows machine and we're going to do a R P A again on perfect as you can
see the rafters MAC address has changed to the same MAC address as the Kali machine and the original
writers MAC address the correct one was this.
So this means that this Windows machine is now spoofed thinking that the candy machine is the router
and the router now thinks that the candy machine is this machine.
This whole place Carly in the middle of the connection and just to confirm this just real quick I'm
already involved in web.
This is the Web site that we tested the log in before I'm actually even still logged in so I'm going
to log out log in again and going to leave the user name to ad men and I'm just going to put a password
again 1 2 3 4 2 9 0 enter.
Well let's go back and perfect as you can see.
We wouldn't be able to get this if we were not in the middle of the connection.
So the fact that we're getting all of this information means that we managed to intercept the data and
see everything the target user sends or receives.
And again we have the user name and the password right here.
Like I said this will only work with ETP.
We will discuss hash TTP as in the next lectures.
But in this lecture I just wanted to show you an easy way of scripting the commands that you often run
with better cup because in the future we're gonna be doing a number of things that rely on us being
the man in the middle.
So because I don't want to waste time enabling all of the modules that we're running here.
So again if I right click this and open with and normal text editor all you'll have to do is just put
your commands in a file give a file a specific name and then when you're on better cop all you have
to do is just use the Capulet argument followed by the name of your calculate file.