Now in this lecture I want to show you how to run an AARP spoofing attack using Buttercup.
This will allow us to place our computer in the middle of the connection and intercept data.
Not only that but we're also going to see how we can read this data so we can see all of your L's and
all the Web sites that the target visits and we'll see everything that they post.
So anything and usernames and passwords they send to any Web sites.
We're gonna be able to capture them and see them.
So first we need to become the man in the middle and we're going to do this using a module called AARP
spoof.
So if I scroll up to the help menu you can see we have a module here called AARP spoof so as usual if
we don't know how to use this module we're going to do help.
AARP though it's proof because we want to see how to use this module and see all the options that we
can set for it.
So as you can see as usual we can do AARP spoof on to turn this module on.
We can do IRP that van on and this will literally just cut the connection off the target.
This is very simple.
You can try it on your own time.
I'm not going to do it here.
You can do AARP spoof of to turn it off and AARP that barn off to turn the barn of now.
In the previous lecture I also said anything you see under the parameters are the options that we can
set for this specific module.
But I didn't show you have to modify that.
So in this lecture we're actually going to be modifying some of these options now as you can see the
tool is actually very helpful because first of all it's given us the option name in yellow here.
So these are the options that we can set that we can change and then it's also telling us a description
of what this option does and the default value so for example we can see we have an option called AARP
that's proof that full duplex.
You can see the description for this option.
And basically what this option will do if you set it to true it will spoof both the outer and the target.
So it's similar to what we did with the AARP spoof when we executed the command twice to spoof both
the rotor and the target.
So if you set this to true both the outer and the target will be spoofed and you will be in the middle
of the connection if you leave it to the default which is false.
You will only spoof the target machine.
Now this can be useful if the writer has some sort of protection against AARP spoofing attacks because
you won't be interacting with the router at all.
But it's also limiting because we won't be able to do what I'm going to do in the next lectures because
the router will communicate with the target device directly.
So we want to be able to inject stuff and the responses that they're after sends to the target device.
Now I actually want to change this to true and the method I'm going to do this can be used to change
any option in any module and cup.
So not only in the ARPU that spoof if you're using any module you can do help followed by the module
name to get help about that module name.
You can see all of the options that you can set in here.
And then if you want to modify the value of any of these options all we have to do is copy the option
name which is what I have right here and type said followed by the option that you want to modify.
And in my case it's called ERP dot spoof dot full duplex.
And I want to set this to true so very very simple.
And like I said you can use this command to change any option in any module and better cup.
All you have to do is type set followed by the option name followed by the value that you want to set.
So I'm going to hit enter and that's done.
If you don't see errors that means it got executed properly.
The next option that I want to change is the targets.
So again in the description it's telling us that these are the targets that I want to run the attack
against.
And I can use a comma if I wanted to target more than one IP at the same time.
So again just like what I did before I'm going to do set followed by the option name which is a sharpie
that's proof dot targets and you can actually use the tab to auto complete.
So if I just type t a tab it'll auto complete the targets for me.
And after this I'm going to put the value that I want to set this.
Option 2 which is the IP of my target and we can get this using net this cover using z map or using
the result that I got in here after I run the recon module I did not show and we got all of this which
is the list of all of the computers connected to the same network.
And my target right now is this particular device the 10 0 2 7.
This is my windows virtual machine right here so I'm going to put the IP 10 0 2 7.
And again we don't see any errors which means that everything got executed as expected.
Now we're ready to run the tool and again based on the help menu that we got we can do a sharpie spoof
on to turn this module on.
So we're gonna do a sharpie that spoof on and perfect as you can see we see no errors.
It's telling us that the module is running and if I do help again we're going to get a list of all of
the modules that are running right now.
And as you can see we can see that a piece proofing is on.
Also it is very important that you make sure that the net dot probe and the net the three con are running.
We did this in the previous lecture.
That's why I didn't do it.
Now so right now Buttercup should be doing what ERP spoofing was doing full and both their outer and
the target device and putting me in the middle of the connection as shown here.
So let's go to the Windows machine right here and I'm gonna do a sharpie a and as you can see the rafters
mac address right here is the same as the MAC address for this device which is the 10 0 to 15.
And if I go back here to the Kali machine and do if config you'll see this is the same MAC address as
the MAC address of the Kali 88 zero interface.
So basically what this means is this Windows machine every time it wants to send something to the router
it will send it to the Kali machine.
And because we set the full duplex option on an better cup the router also thinks that this Kali machine
is the target machine.
Therefore anytime it needs to send a response to the Windows machine it will actually send it to better
right here and like I said before this means every user name password you are L anything.
The target computer sends or receives will have to go through the Kali machine where we're going to
be able to read it modify it or drop it and I'm going to walk you through that and the next lectures.