Lecturer: In the previous lectures,
we learned how to use Bettercap
to discover all clients on the same network,
run an ARP spoofing attack to intercept the data
and then sniff data to see the usernames, passwords,
and everything that's getting sent over the network.
Now in order to do this,
we actually had to run a number of commands.
So first of all, we had to do net.probe on,
to turn on the probe module.
We had to set the settings for the ARPspoof module,
turn that on, and then turn the sniffing module on.
Now, every time you want to do this,
every time you want to intercept data and see it onscreen,
you're gonna have to do all of the steps that I showed you
in the previous lecture.
Or if you're lazy like myself,
you can use a caplet to do all of that automatically,
which is exactly what I wanna show you in this lecture.
So what do I mean by a caplet?
Well, basically a caplet is just a text file
that contains all of the commands that you want to run.
So I'm gonna resize this menu.
I'm gonna open a text file
and I'm just gonna organize this a little bit
to make it easier to follow
and I'm gonna clear this window here
and I'm gonna go to the first command that we had to run
in order to do this.
So again scrolling up, the first thing we did
was net.probe on.
So in my text file here,
I'm gonna literally type this command, net.probe on.
And as we saw, this will automatically start
the net.recon module.
Again, we enabled both of these modules
in order to discover the connected clients
and keep automatically discovering any new clients
that connect to the network.
The next thing that we did
was modify the settings for the ARPspoof module.
So we did set ARPspoof full duplex to true.
I'm gonna actually copy this and paste it here.
Then we set the target IP.
So again, I'm just gonna copy this and paste it here
and keep in mind this is very important.
You wanna make sure that you change the IP here
to the IP of your target all the time.
And if you are targeting multiple computers,
you can just use the comma
and type the next IP after the coma.
Next we turned on the ARPspoof module.
So again, this is what I'm gonna do here.
I'm gonna do arp.spoof on.
And finally we also run the sniffer by doing net.sniff on.
So again, I'm just gonna type this in here, net.sniff on.
So this is actually a nice summary
of what we did in the previous lectures.
Again, like I said,
every time you wanna intercept the connections,
you're gonna have to start Bettercap
and run all of these commands manually.
You wanna start the probe module,
you wanna enable the full duplex.
So you full or spoof the target and the router.
You wanna set your target IP
and you wanna turn on the spoof and turn on the sniff.
So to make this very easy,
instead of having to type this every time
we want to run an ARP spoofing attack and intercept data,
I put all of this in a text file.
I'm gonna save this text file.
I'm gonna put it in my root directory
and I'm gonna call it spoof.cap.
So I'm gonna save this now and I can close it
because we're done with it and we can go back here.
And what I'm actually gonna do, I'm gonna exit out of this.
So I'm gonna quit Bettercap and I'm gonna clear the screen.
And if I do LS to list all of the files and directories
in the current working directory,
because right now I am in root.
So if I do LS, you can see we have a new file
called spoof.cap.
And just to confirm,
if I go down to my file manager right here,
you can see we have a new file, again in the root
called spoof.cap.
And all we want to do, is feed this spoof file
to Bettercap before we start Bettercap.
Now, we don't know how to do this,
so we're gonna do bettercap--help to see all of the options
that we can set with Bettercap.
And what we want to do is use the -caplet option right here.
So we're gonna run Bettercap like we used to do.
First of all, we do Bettercap followed by iface
to specify the interface that is connected
to the target network and in my case this is ETH0.
So, so far this is identical
to what I've been doing in the previous lectures.
The only difference now,
is we're gonna use the -caplet option
to specify my caplet file that I just created.
So I'm gonna do -caplet
followed by the file that I just created,
which is called spoof.cap and that's it.
Now, before I hit enter, just to confirm to you,
I'm gonna go back to my windows machine
and I'm gonna do ARP-a to show you.
And as you can see right now,
the router's IP right here, has this MAC address.
So after I run this,
it should automatically start all of the modules
that I just typed and it should run an ARP spoofing attack.
Therefore, the router's MAC address
should change to the MAC address of ETH0
that is connected to kali right here.
So I'm gonna hit enter and as you can see,
we actually got an error
and the error is saying the caplet spoof could not be found.
So I'm suspecting I made a spelling mistake and I did.
As you can see, I actually named the caplet soof not spoof.
So I actually make a lot of mistakes like this.
So I'm just gonna rename this to spoof
and we're gonna go back here.
I'm gonna exit and run the same command again, and perfect.
As you can see, we got no errors at all.
If I do help, as you can see
automatically we have this spoof is running.
We have the probe, the recon, and the sniff all running
as soon as we run Bettercap.
If you remember the first time we ran it,
we only had the stream running
and we had to do everything manually
and set the options manually.
So this is a really, really nice way of doing it.
Now let's confirm that everything is working as expected.
So I'm gonna go to the windows machine
and we're gonna do ARP-a again.
And perfect, as you can see, the routers MAC address
has changed to the same MAC address as the kali machine
and the original routers MAC address,
the correct one was this.
So this means that this windows machine
is now spoofed, thinking that the kali machine is the router
and the router now thinks
that the kali machine is this machine.
This will place kali in the middle of the connection.
And just to confirm this, just real quick,
I'm already in vulnweb.
This is the website that we tested the login before.
I'm actually even still logged in.
So I'm gonna log out, log in again,
and I'm gonna leave the username to admin
and I'm just gonna put a password again,
one, two, three, four to nine zero, enter.
Let's go back and perfect.
As you can see, we wouldn't be able to get this
if we were not in the middle of the connection.
So the fact that we're getting all of this information
means that we managed to intercept the data
and see everything the target user sends or receives.
And again we have the username and the password right here.
Like I said, this will only work with HTTP.
We will discuss HTTPS in the next lectures.
But in this lecture I just wanted to show you an easy way
of scripting the commands that you often run with Bettercap
because in the future
we're gonna be doing a number of things
that rely on us being the man in the middle.
So because I don't want to waste time
enabling all of the modules that we're running here.
So again, if I right click this
and open with a normal text editor,
all you'll have to do is just put your commands in a file,
give a file a specific name,
and then when you're on Bettercap, all you have to do
is just use the caplet argument,
followed by the name of your caplet file.