Ziad: In the previous lecture,
we learned how to use BetterCAP
to run an ARP spoofing attack
and place ourselves in the middle of the connection
between a computer and the access point.
And every time I do this,
I keep saying this means that all the requests
and all the responses will flow through our computer,
which means that we'll be able to see anything
a user does on the Internet.
So we should be able to see the URLs,
the images, the videos,
the passwords they login with
or anything they send or receive.
So right now, we are already in the middle of the connection
and this data is already flowing through our computer.
So all we have to do is just use a program
to capture this data and analyze it.
Now we can use Wireshark to do that,
and I will cover this later on in the course,
but for now I'm gonna use a really nice module
that comes with BetterCAP,
that will automatically capture all of this data,
analyze it and show me the interesting stuff.
So all we have to do now is to tell BetterCAP
to capture all of the data
that is flowing through this computer
and analyze it for me.
And to do this, we can use the net.sniff module.
So you can do help followed by net.sniff
to see all of the options that you can set for this module.
But I showed you how to read options and change them,
so for now I actually wanna run it
without modifying any of the options,
so I'm just gonna do net.sniff on.
So now everything that's gonna flow through this computer
will be captured and analyzed by the net.sniff module.
So I'm gonna close this terminal window
and let's go to the target Windows computer.
I'm gonna open my web browser
and we're gonna generate some traffic
and see if that's gonna be captured by BetterCAP.
What we're doing right now
will not work against HTTPS
but don't worry,
we'll talk about how to bypass HTTPS later on
and why this won't work.
But for now, for testing,
I'm just gonna to a website called vulnweb
and I'm gonna include it's link
in the resources of this lecture.
So as you can see this is a normal website
that doesn't use HTTPS.
It also has a number of links here,
so if I click, for example, on this link,
everything is loading fine
as you can see here.
But if we go to the Kali machine,
you'll see that every request that we sent
was actually captured by this computer.
So you can do this to any computer
that is connected to the same network as you,
whether it's a wired or a wireless network.
So you can see there were requests sent to Google,
if we scroll down,
you will see we made a request
for this website, vulnweb.com.
You can also see all of the other files
that this website loaded.
So you can see we have a logo loaded here.
You can see we have a styles file being loaded here.
Again, if there were more images,
you'll actually see links to all of the images
that are being loaded.
You can see here this is the second link
that we clicked on, the testphp.vulnweb.com.
So this is what we have right here, here in the top.
Now also, let me just go back
and maybe click on the first one.
And as you can see,
this is another website.
It has the login functionality in here.
And let's try, for example,
login with a username.
Let's set the username to my name, ziad sabih.
And let's put the password as 1234567890.
I'm gonna click on Login.
Again, as you can see,
we got logged in, no issues at all.
But if I go back to the Kali computer
and scroll up,
as you can see, we captured a login
that was sent to this website, testhtml5.vulnweb.com.
Again, this is exactly the website that we have here
and if you look in here,
you can see that the username was ziad sabih
and the password was 123 all the way up to 90.
So basically the idea that I'm trying
to get across right now,
anything that the target computer sends
or receives right now will be captured by the Kali machine.
And like I said, we can do this to any computer
or any phone that is connected to the same network as us,
whether it's a WiFi or a wired network.