Instructor: Now that we know how ARP spoofing works.
Let's see how we can run this attack
and redirect the flow of data
so it flows through our device.
This will allows us to intercept data
and see everything sent to and from a target computer
including, usernames, passwords and so on.
Now there are a number of tools that can be used
to run an ARP spoofing attack,
you can even build your own tool
and I covered this in my Python programing course.
But in this lecture I wanna show you
how to use a very simple yet reliable tool called arpspoof,
then in the next lectures we'll use
a tool called BetterCAP because it has more features.
Basically, the main reason why I want to cover arpspoof
in this lecture, because it is a very simple tool
but it's very reliable.
It's also ported to many operating systems,
including iOS and Android.
Therefore if you learn how to use it here
you'll be able to use this tool
on all of the other operating systems.
So you can only use this tool to redirect the flow of data
and make it flow through your computer,
and then you'll have to use another tool
like a packet sniffer like Wireshark to analyze this data
and do more stuff with it,
and we'll cover all of this later on in the course.
Now, using arpspoof is very simple.
First, we're gonna have to type its name.
So it's arpspoof then we're gonna do dash I,
to specify the interface that is connected
to the target network and in my case it is eth0,
because that's the interface that's connected
to the network.
So if I do, ifconfig,
you'll see eth0 is the interface that's connected.
Now as you can see I'm gonna be running this attack
against my virtual not network.
You can run this attack against any type of network,
even Wi-Fi networks and I will cover that
later on in the course.
But for now just until you properly understand
how this works, I highly recommend you
do like I'm doing right now
and test the attack against the virtual node network.
So all you'll have to do is make sure the Kali machine
and the target windows machine are both configured
to use the same node network.
So, we're gonna do dash t to specify the target
and my target is at 10.0.2.7.
As you can see in here that is the IP of my target.
And I'm gonna have to give it the IP of the gateway
which is 10.0.2.1
as you can see in here.
Now this will spoof the target,
telling him that I am the router.
We'll also need to run this command once more in here.
So, I'm gonna clear the screen and again I'm gonna do
arpspoof -i eth0
and the target this time is going to be 10.0.2.1
and 10.0.2.7.
So right now we're gonna be telling the router
that I am the victim,
so the first one will fool the victim,
the second will fool the router.
Now keep in mind this attack will work against both internet
and Wi-Fi or wireless networks.
I'm running it right now against the virtual networks
which acts as an internet or a wired network,
but the attack can be executed exactly the same
against wireless networks.
All you have to do is connect a wireless adapter
to the Kali machine,
connect the adapter to the target network and use it.
So the same concept as the networks kinda applies.
You need to have a wireless adapter
that works well with Kali
and you need to have that adapter connected to Kali
and connected to the target network.
So, I'm gonna hit enter here
and I'm gonna hit enter here,
and now if we go to the target machine
and run the same command arp -a,
you're gonna see that the MAC address now
for the router is different than what it was,
and this is the MAC address of the Kali machine.
So right now, this window's machine
thinks the router is at this MAC address
and every time it needs to send a request
it will send it to this MAC address,
which means that they will be sent
to this computer right here.
Now, this computer is not a router so when it gets requests,
it's actually going to stop them from flowing
and going to the router.
This is a security feature in Linux.
So, you need to enable port forwarding so that
this computer would allow packets to flow through it
just like a router.
Now to enable port forwarding,
we're gonna do echo one to proc/sys/net/ipv4/ip_forward,
and as you can see this command
gets executed with no issues.
And right now this computer
will still have its internet access,
so we can go and browse any website we want,
but all these requests are not going directly to the router,
but they are going to this computer first
and then this computer is forwarding them to the router,
as shown in this diagram, and then when the response's
come back they are gonna go to the hacker first,
and then they go to the victim.
So as you can see a very simple tool,
it allows us to redirect the flow of data
so it flows through our computer
allowing us to become the man in the middle,
and once we're the man in the middle,
we can inject code in the browser of the target.
We can steal usernames, passwords,
see all the information that the person sends and receives,
replace downloaded files with Trojans and much much more.