Instructor: Previously we learned what ARP spoofing is
and how to use it to intercept connections in our network
using a tool called ARP Spoof.
I covered this tool because it is simple, reliable,
and available for a number of operating systems.
Therefore learning how to use this tool can be useful
in so many scenarios.
However, in this lecture and in the next lectures,
we're going to be using a tool called Better Cap.
Better Cap can be used to do exactly what we did
with ARP Spoof.
So we can use it to run an ARP spoofing attack,
to intercept connections,
and it can be used to do so much more.
So we can use it to capture data and analyze it
and see usernames and passwords.
We can use it to bypass HTTPS and potentially bypass HSTS.
We can use it to do DNS spoofing,
inject code into loaded pages
and so much more.
For now, though I'm going to show you
how to install the tool
and give you a quick overview on how to use it.
And we'll go over all of that in the next lectures.
So I'm going to go to my Cali machine here
and to run Better Cap, all I have to do now
is just type its name, Better Cap.
Now, as usual,
if you want to get more information on this command
and how to use it, you can do dash dash help.
And this will give you a complete help menu,
but you don't really need to worry about this now
because we will be using the tool
a lot throughout the course,
and you will learn a lot as you use it.
So I'm going to clear the screen again.
And to run the tool now I'm going to type Better Cap,
the name of the tool,
followed by dash iface.
To specify the interface that is connected
to the network that I want to run the attacks against.
And as you know, to get my interface,
we can just do if config.
And I'm going to be running this against my net network,
which is ETH0 is connected to,
so I'm going to set my interface to ETH0.
I'm going to close this.
And I'm going to hit enter to run the tool.
And as you can see, now we're inside the tool.
We have a different prompt now
in which we can use the commands of Better Cap.
Now as you can see here,
it's telling us that we can type help
to get a list of all of the commands
that we can use with Better Cap.
And since we don't know how to use it,
I'm actually going to type help.
And perfect.
As you can see,
we get a full list of all of the commands that we can use.
Again, I'm going to use it with you now
as we go through the course,
so you can have a quick look on them,
but don't worry too much about them.
What's really important.
And you need to pay attention to right now is the modules.
So these are all of the modules that we can use
or all of the things that we can get Better Cap to do.
And as you can see right now,
none of them is working, except for the event stream,
which is basically the module that runs in the background
to handle all the events.
Now you can type, help.
Followed by the name of any module you want.
And this will show you a help menu
that shows you how to use this specific module.
For example, I want to show you in this lecture,
the net dot probe and the net dot recon modules.
So since I don't know how to use them, I've typed help,
and I'm going to follow it by the name of the module.
Which is net dot probe.
I'm going to hit enter.
And as you can see,
you'll get a description of what this module does.
So basically it keeps sending UDP packets
to discover devices on the same network.
And we can do net probe on,
to turn on the module and net dot probe off,
to turn it off.
You can also see all the options
that you can modify for this module.
And I'm going to talk about options
and how to modify them in the next lecture.
So for now,
I'm going to keep all these to the default option,
and I'm just going to do,
net dot probe on to turn it on.
And as you can see,
this'll automatically start discovering clients
connected to the same network.
So the 10.0.2.7 right here
is actually my windows target machine.
So if I go to the target windows machine right here
and do IP config, you'll see its IP address is 10.0.2.7.
So this is just another way
of discovering connected clients quickly using better cap.
And what you didn't notice right now
is when we started the net dot probe,
it automatically started the net dot recon.
To confirm this, so if we go upright here,
you can see the only module that was running
is the events dot stream.
And now if I do help,
you'll see, I actually have two modules running
the net dot probe, which we just saw
and we turned on manually.
And the net dot recon,
which got turned on automatically by Better Cap.
The reason for this is because the net dot probe
sends probe requests to all possible IP's.
And then if we get a response,
the net dot recon will be the one
detecting this response by monitoring my ARP cache.
And then adding all of these IP's in a nice list
so we can target them.
So now, because the net dot recon is actually running,
we can do net dot show, to see all of the connected clients.
And as you can see,
we get a nice list of all of the connected clients.
We can see their IP's.
We can see the corresponding Mac addresses
for these clients.
And it can also show you information right here
about each one of these IP's.
For example,
it's telling us that this IP right here
is the IP for ETH0.
So this is the IP of this computer.
It's also telling us that this IP right here is the gateway.
This is the IP of the router,
and you can also see at the vendor in here
it's attempting to discover the manufacturer
of the hardware used in each of these clients.
So as you can see for the gateway,
it thinks that it uses a Realtek chip set.
Now you can also see here the 10.0.2.7 device.
Like I said, this is my target Windows device right here.
So that's it for this lecture.
I just wanted to give you a quick overview
on how to get help about a specific module,
how to run a specific module
and analyze the results that it returns.
And in the next lecture,
I'm going to show you how we can run an ARP spoofing attack
using Better Cap to intercept the data
and read usernames and passwords
that flow through the network.
Once we become the man in the middle,
once we intercept the connection.