[Lecturer] Now, in this lecture and the next few lectures
I wanna start talking about Man In the Middle Attacks.
These are attacks that we can launch
only if we are able to intercept
the communication between two devices.
Hence the name, Man In The Middle Attacks.
So a normal communication would look like this,
where the device is directly communicating with the entity
that they want to communicate with.
In a Man In The Middle Attack,
the hacker would be able to place themselves
in the middle of the connection,
allowing them to intercept and see anything
that is being transferred between the two devices.
Now, there are a number of ways to achieve this.
The first method that we'll cover in this course
is using an ARP spoofing attack.
ARP spoofing allow us to redirect the flow of packets
so instead of it flowing as shown in this diagram,
it would flow through my own computer.
So any requests sent and any responses received
by the target computer,
will have to flow through the hacker computer.
This means that any messages, any websites, any images,
any usernames, any passwords entered by the target
will have to flow through my computer.
This allows me to read this information,
modify it or drop it.
So as you can see,
this is a very serious and very powerful attack.
And the reason why it is possible
is because ARP is not very secure.
Now for us to understand how this works,
you need to have a basic understanding of what ARP is.
ARP stands for Address Resolution Protocol,
and it's a very simple protocol
that allow us to link IP addresses to MAC addresses.
So for example, let's say we have a network here,
we have devices A, B, C, and D.
They're all connected to the same network.
And we have the router here for this network.
We can see that each device has an IP and a MAC address.
Let's assume that device A
needs to communicate with device C.
Now we're also gonna assume
that device A knows the IP of device C.
But as we know so far,
in order for these devices to communicate
within the same network,
device A needs to know the MAC address of device C.
Because like we said before,
the communication inside the network
is carried out using the MAC address
and not using the IP address.
So this is a perfectly normal situation where have a client
that needs to know the MAC address of another client
so that it can communicate with this client.
So what this client does, it uses the ARP protocol.
What do I mean by that?
Basically, it sends a broadcast message.
So it sends an ARP request to all the clients on the network
saying who has 10.0.2.6?
Now all of these devices will ignore this packet
except the one that has this IP address,
which is 10.0.2.6, which is device C.
So all devices will not do anything
and the only device that will respond is device C
sending an ARP response.
In this response, device C is gonna say I have 10.0.2.6,
my MAC address is this MAC address.
This way device A will have the MAC address of device C
and now it will be able to communicate with device C
and do whatever task that it wanted to do initially.
So all of this communication
is facilitated using the ARP protocol.
Like I said, the ARP protocol
is a very simple protocol as you can see.
All it has is requests and responses
and the whole point of it
is so that we can link IP addresses to MAC addresses
or translate IP addresses to MAC addresses.
So a device can send a request asking for a MAC address
and then the device that has the MAC address
would respond with its MAC address.
So each computer have an ARP table,
which links IP addresses on the same network
to their MAC addresses.
So if I go on the kali machine and do ARP-a,
you can see my ARP table here and as you can see
it's linking the router's IP to the router's MAC address.
Now same if I go to the windows machine
and run my CMD and do ARP-a, you'll see again,
it's linking the router's IP to its MAC address.
So this machine,
anytime it needs to send any request to the Internet,
it will direct that request to this MAC address,
to the MAC address that's associated
with the IP of the router, which is 10.0.2.1.
Now this value in here, can be easily modified
by exploiting the ARP protocol.
So let me go back to my diagrams
and right here we have a diagram of a typical network
and you can see that normally
any device that's connected to the network,
if it wants to send a request,
it will send them to the router, the router will go
and send that request to the Internet, wait for the response
and then forward the response
to the device that requested it.
So if the hacker or the victim
or any other computer on the network
wanted to send a request,
they will send that request directly to the router.
Now what we can do is we can exploit the ARP protocol
and send two ARP responses,
one to the gateway and one to the victim.
We're gonna tell the gateway
that I am at the IP of the victim,
so the access point will update its ARP table
and it'll associate the IP of the target
with my MAC address.
We'll do the same with the victim,
so we'll send it an ARP response.
We're gonna tell it that I am at 10.0.2.1
so it's going to update its ARP table
and associate the IP of 10.0.2.1 with my own MAC address.
So the result of this, the victim is gonna think
that I am the router and the router is gonna think
that I am the victim.
So anytime the victim wants to send any requests,
the requests will have to flow through my computer
and I'm gonna forward them to the router.
And then anytime the access point or the router
wants to send responses, they're gonna go to my machine
because it thinks that I am the victim
and then I'm going to forward it to the victim.
So as you can see,
this puts me in the middle of the connection
and it gives me so much power
and we'll see all the things that we can do
once we become the Man In The Middle.
Now the main reason why we can do all of this
is because ARP is not secure.
Because first of all, clients can accept responses
even if they did not send a request.
So as I said before,
we're gonna send a response to the access point
and a response to the victim
telling them that I am at a specific IP
without them asking who am I
or without them asking for this IP.
I'm just gonna send the response
and they're gonna accept that response anyway.
Not only that,
well, they're also not going to verify who I am.
So when I say that I am a 10.0.2.7
I am clearly not at that IP
because this computer is at this IP.
But the access point will trust this
and it'll actually update its ARP table
based on the information that I sent.
Same goes to the victim.
I'm gonna tell it that I am at 10.0.2.1
it's gonna trust and believe this,
even though I am clearly not at this IP
because the access point is at this IP.
So these are the two main weaknesses with ARP protocol
that allow us to run ARP spoofing attacks.