[Autogenerated] Hey there.
I'm Rick Iroh.
I'm a separate security specialist and I'll be showing you how to harvest
credential using fake captive Porter's created by the wife.
Five pumpkin, too.
So invention that your newly promoted manager at Global Man Tick
You're in a tight deadline to deliver a report today.
But for some reason,
your WiFi right now is not the best it could get into connected and you
start to get a piece off because his delay in your work.
So you take a look to see if there's any other wife and attacks around you.
Then you find his global Mantex corporate network as your wife is really bad.
You connected this one.
The first thing you see is a page with the global Mantex logo asked him
to look again so you can access the internal network.
You take your credentials and you look into the net trick perfect rate.
Everything works and in turn so fast that even tell your
colleagues to connected a new global Matics WiFi.
The only problem is his wife friend metric was
actually created by a malicious person.
And this captive porter is a fake up to porter creating used the WiFi pumping,
and this means they're your credentials are now in
the hands of a malicious person.
And just like that, you have a recount compromised.
The wife I've pumpkin Framework is one of my favorite tools in a neighbor's too
easily perform several worlds attacks in just feel clicks.
This, too, was developed by Michael's bone Thin and his team at the PLC labs.
And thanks to them, my life as a red team specialises ways.
Er, they did an amazing job at putting out the main wife for attacks.
No one single, too, that is reliable and easy to use.
So thanks, Michael.
And if you like the two s, I do,
don't forget to go to their get hub and even leave a donation for them.
The wife of pranking is a rogue access point framework too
easily create fake wife right networks.
The interesting part of this, too,
is that includes several mortars such as transferring proxy
are poisoning fishing manager and much more.
The module be discussing today is the captive port of Marshall,
which is a red included by default.
In the latest wife.
I bump key versions.
They're really cool thing about this, too.
Is that an open source?
And they get new version three,
which means that it can Donald the source code and customize it as most is one.
We'll download this tooth from their official get help,
which also contains tones of the commendations and to
tour of teaching how to use the tool.
As you seen this course.
It is really easy to install and use the two,
and it comes with several attacks out of the box,
such as pecking injection,
HDP credential monitoring are poisoning Dennis spoofing and,
of course, fake captive porters.
Those tools are a prince told me that in less than five
minutes you can set up an attack, which is very handy.
We're in the middle of a red team exercise.
If you're familiar, The Red Team Q Ching.
This, too,
can be used during the recall and exploitation faces in which we're
trying to figure out a way to get into the company and using valid
credentials is a release a way of doing that.
So if in mapping techniques that we learned this
course to the minor attack framework,
we see that we're focusing one main area which is initial access inside
of the initial access week over two main techniques.
The 1st 1 is a T 14 65 which is a creation off road access
points and with a rogue access point,
we will create a fake captive portal to harvest vile accounts,
which is a technique t 10 78 on the minor attack framework.
As you see, we combined it to techniques into one attack.
In my opinion, the best way of learning something is by singing it.
So let me show you How does attack works?
Let's say you were trying to attack global Mantex.
They have their internal data center,
the internals switches and one wife friend network in which most of
the employees connect to while in your re com Phaze.
You saw that these WiFi network is called global Mantex.
Cooperate.
So what do we do?
Is creating a wife like access point with the singing or
similar name to the regional WiFi network.
For example, we can use global Mantex dash,
cooperate or even something like Global man tick secure WiFi.
Once we have the access point day, we have two options.
We can simply wait for people to connect to a network or if the client agrees,
we can cause instability in the original wife,
a network.
So then people look for a new network.
In any case,
people start to disconnect from the current network and start
to connect to a fake a WiFi access point.
As soon as they connect,
they'll be prompted with a looking page that looks like from global Mantex.
And this looks like a captive porter in the hotel or in the airport,
which means it don't look into the poor.
Oh, you don't have accident at TriC.
So then thing, please.
Well timed their credentials into this form and when they submitted,
will be able to capture the credentials.
Pretty cool, right?
We can easily get some valid accounts also,
if you have your computer connect to the Internet after its indication,
the wife of pumping would then allow the person to access the Web.
Basically, the two bridges, the rogue WiFi access points,
tow whatever you have connected in your order network interface.
So if you have access to an Ethernet port in the client,
let's say on the meeting room the people that connect to
your access point who have access to the Internet trick and
will not suspect about anything.
Also, even though it may take some time for people to connect her,
your wife I Once they do, you have clear tax passer for someone in the company,
meaning that will be able to look in the A VPN or use
the credentials to access the email.
Personally,
I like to set up a fake access point writing the beginning of the engagement.
So then I can go to some other writing tests and come back
later to check if I got any credentials.
One thing that'll save me a lot of time.
It's having the WiFi pumping set upon a raspberry pi or in a spare laptop.
So then I can just hide it somewhere and leave it harvesting credentials.
Then, in the end of the date,
I can go back and check if I got any user names and passwords.
But before getting to the technical part of this course,
I want you to keep in mind that performing this attack without
authorization isn't leaving most of the countries,
and this means if you create a fake WiFi in the airport or a
library with intent of stealing credentials.
You may go to jail, and that's not cool.
So it is important to stay legal first.
If you're working on writing project,
make sure you have a letter for engagement From Declined
detailing the dates of the test to be executed,
as was the types off attacks _____ scope also is important to
have a formal document signed by the client detailing in
authorizing the taxi will be performing.
And this is the document differentiates a criminal from professional
retina specialist and has a personal recommendation.
Always consulted the clients before executing any attack
that may cause impacting the network.
So but online.
Don't be a criminal to follow the demos.
In its course, you need two things.
The 1st 1 is a laptop or a virtual machine with calla ranks.
In theory,
it can use the Annie Lennox abortion you want as long as
you saw under The penance is on it.
However,
I do like to use color remarks because most of the
dependence is already sold here.
I'm using the cattle Lennox's version 2019.4.
I do recommend using the specific version because it has all
the libraries that we need for this demo.
But if you want to use the newer kind of Linux versions,
you may need to Mannering startup Iten Q T for library.
The second requirement is a WiFi network card that supports monitor mode.
If you're not familiar monitor mode,
it basically means that the network card should be able to sniff
wireless traffic and inject packets into the world.
Is that just go?
Go network card monitor mode,
and you find out about the network cards that supports monitor mode.
My two favorite network cards are the TP Link 7 to 2 n and the Alfa 0 36 in H.
Both of them are supported by color and eggs and the WiFi pumpkin, too.
In this demo amusing tippling, which appeal isn't $15 on Amazon.
So if you're ready,
let's go to color next and see how to harvest some credentials.