Lecturer: Now, in this lecture,
I wanna show you how to run an ARP spoofing attack
using Bettercap.
This will allow us to place our computer
in the middle of the connection and intercept data.
Not only that, but we're also gonna see
how we can read this data.
So we can see all the URLs
and all the websites that the target visits
and we'll see everything that they post.
So anything any usernames, any passwords
they send to any websites,
we're gonna be able to capture them and see them.
So, first we need to become the man in the middle.
And we're gonna do this using a module called ARP spoof.
So if I scroll up to the help menu,
you can see we have a module here called ARP spoof.
So as usual, if we don't know how to use this module,
we're gonna do help arp.spoof,
because we want to see how to use this module
and see all the options that we can set for it.
So as you can see, as usual,
we can do arp.spoof on to turn this module on.
We can do arp.ban on
and this will literally just cut the connection
of the target.
This is very simple.
You can try it on your own time.
I'm not gonna do it here.
You can do arp.spoof off to turn it off
and arp.ban off to turn the ban off.
Now, in the previous lecture I also said
anything you see under the parameters
are the options that we can set for this specific module.
But I didn't show you how to modify that.
So in this lecture,
we're actually gonna be modifying some of these options.
Now as you can see, the tool is actually very helpful
because first of all it's given us the option name
in yellow here.
So these are the options that we can set,
that we can change.
And then it's also telling us
a description of what this option does
and the default value.
So for example, we can see we have an option
called arp.spoof.fullduplex.
You can see the description for this option
and basically what this option will do
if you set it to true,
it will spoof both the router and the target.
So it's similar to what we did with ARP spoof
when we executed the command twice
to spoof both the router and the target.
So if you set this to true,
both the router and the target will be spoofed
and you will be in the middle of the connection.
If you leave it to the default, which is false,
you will only spoof the target machine.
Now this can be useful
if the router has some sort of protection
against ARP spoofing attacks
because you won't to be interacting with router at all.
But it's also limiting because we won't be able to do
what I'm gonna do in the next lectures
because the router will communicate
with the target device directly.
So we won't to be able to inject stuff
in the responses that the router sends to the target device.
Now, I actually wanna change this to true
and the method I'm gonna do this
can be used to change any option
in any module in Bettercapp.
So not only in the arp.spoof.
If you're using any module,
you can do help followed by the module name
to get help about that module name.
You can see all of the options that you can set in here.
And then if you want to modify the value
of any of these options, all we have to do
is copy the option name, which is what I have right here
and type set, followed by the option
that you want to modify.
And in my case it's called arp.spoof.fullduplex.
And I wanna set this to true.
So very, very simple.
And like I said, you can use this command
to change any option in any module in Bettercap.
All you have to do is type, set,
followed by the option name,
followed by the value that you want to set.
So I'm gonna hit enter and that's done.
If you don't see errors,
that means it got executed properly.
The next option that I wanna change is the targets.
So again, in the description,
it's telling us that these are the targets
that I want to run the attack against
and I can use a coma if I wanted to target more than one IP
at the same time.
So again, just like what I did before,
I'm gonna do set, followed by the option name,
which is arp.spoof.targets.
And you can actually use the tab to auto-complete.
So if I just type T-A tab,
it'll auto complete the targets for me.
And after this I'm gonna put the value
that I want to set this option to,
which is the IP of my target
and we can get this using net discover, using zen map
or using the result that I got in here.
After I ran the recon module, I did net.show
and we got all of this,
which is the list of all of the computers
connected to the same network.
And my target right now, is this particular device,
the 10.0.2.7.
This is my windows virtual machine right here.
So I'm gonna put the IP 10.0.2.7.
And again, we don't see any errors,
which means that everything got executed as expected.
Now, we're ready to run the tool.
And again, based on the help menu that we got,
we can do arp.spoof on to turn this module on.
So we're gonna do arp.spoof on.
And perfect, as you can see, we see no errors.
It's telling us that the module is running.
And if I do help, again, we're gonna get a list
of all of the modules that are running right now.
And as you can see, we can see that ARP spoofing is on.
Also, it is very important that you make sure
that the net.probe and the net.recon are running.
We did this in the previous lecture.
That's why I didn't do it now.
So right now, Bettercap should be doing
what ARP spoofing was doing,
fooling both the router and the target device
and putting me in the middle of the connection
as shown here.
So, let's go to the windows machine right here.
And I'm gonna do arp-a and as you can see,
the routers MAC address right here
is the same as the MAC address for this device,
which is the 10.0.2.15.
And if I go back here to the Kali machine
and do ifconfig, you'll see this is the same MAC address
as the MAC address of the Kali ETH0 interface.
So basically, what this means is this windows machine,
every time it wants to send something to the router,
it'll send it to the Kali machine.
And because we set the full duplex option on, in Bettercap,
the router also thinks that this Kali machine
is the target machine.
Therefore, anytime it needs to send a response
to the windows machine,
it'll actually send it to Bettercap right here.
And like I said before, this means every username, password,
URL, anything the target computer sends or receives
will have to go through the Kali machine
where we're gonna be able to read it, modify it, or drop it.
And I'm gonna walk you through that in the next lectures.