HEY EVERYBODY WELCOME TO next video.
We're gonna be looking at art spoofing.
This is also known as man in the middle type attack.
So what happens in this particular attack is you take your intercepting the vulnerability between the
time it takes for the router to make an R response of its MAC address to a victim machine and the frequency
of which the ARP table updates.
So if we take a quick look at our ARP table here we can see that we have our one dot one which is our
gateway which has this hardware address.
Now every so often I don't know the exact number off the top of my head but at a very frequent rate
it go ahead.
It goes ahead and updates and sends a request for who has the.
Who has won that one.
When I do want to say one dot one and everything on this list actually.
And when you go ahead and attempt to access or paying or connect to a new machine that you have not
connected to before that's local it will go ahead and put the ARP entry into the table here and then
it will go through it as part of the update process.
But what happens is is when you an attacker and you tell the victim machine or you keep sending out
our broadcast request that say 1 9 2 1 6 8 1 dot 1 is at the attackers hardware address.
So instead of saying that it's instead of the router saying that it's this it comes back and says since
this is our attack machine it says that this is the hardware address for the router.
So when the client machine goes ahead and updates it's our table it will see our response first before
the routers we're sending it out at a much faster rate.
And by the time that the victim machine sends it out and waits for a response we have already sent the
response before the router should have gotten the request.
So we almost guarantee that it's going to hit us.
It's going to be using ours first.
And then on the victim machine there ARP table will now say that they're one dot one is no longer this
guy up here but instead the attacking machine and that's just one part of the loop.
So that means when a victim machine goes ahead and use a web page or connects to a different machine
it will go through us first.
But if we're not telling the router that the attacking machine us is the victim.
So in this case it's going to be the one that 20 to if it's not saying that we're the victim it's going
to send all of its traffic back to the correct victim.
And when that happens the victim's not going to understand the victim machine is not going to know where
these packets came from it's out of sequence it doesn't recognize the connection so it'll just go ahead
and cancel the connection or drop the packet and this can cause their internet to drop immediately which
is very obvious so what we need to do is we need to ARB spoof the client victim machine as well as the
router to make the router think we're the victim and to make the victim think where the router as long
as all of those pieces come together in our machine is set up for the traffic we should be able to view
the traffic that occurs.
So what we're going to do is we're going to enable IP forwarding on our Kelly or attacking machine as
a quick thing are attacking machine is one dot 24 and we're going to echo one into proc net this IP
before and then IP forward.
So that's a proc sis net ip for ip forward.
So that sets up IP forwarding immediately on our system and now we need the first thing we need to do
is the first leg of this and we need to tell the victim machine that we are the router so we can do
that with our spoof
now our spoof takes a dash eye which is the Ethernet device on this attacking machine.
So where we want to send the traffic out from and then dash TIF is for victims so wanting to 168 that
wound up.
Twenty two.
And then dash ah for our router 1 2 1 6 1 6 8 1 1.
So what's going to happen here is you're going to see our reply one dot one is at blank and then one
dot.
Twenty two is blank so that works fine.
That's the first leg Morgan newsroom won't open up another tabs we've got this one running against our
target but we want to do is reverse that and make our target our router and make our router our target.
And we'll do our spoof.
Think it's a little bigger
dash E for our dash eye.
And then our Ethan address
then we're gonna do our dash T which is our wanted to 1 6 8 one 1 not 1 and one or two.
Once you take that one twenty two.
So we're gonna go ahead and reverse that now with these both running open up another tab and we'll go
ahead and open up wire Sure
and that's fine we'll just open up the first make sure Etho or whatever your default one is checked
and go and capture packets.
So what you can see here immediately is we're seeing one dot one and one at twenty two is at our IP
or are our physical address.
So that's our physical address the fifty four five D a four.
And you can see that just consistently blasting them out.
This is to blast out against the router thinking the attackers the victim and to the victim thinking
the attackers the router.
So what we're gonna do is we're going to do not we don't want to see any outbreak and we'll go ahead
and reset this.
So what I'm going to do is go ahead and execute something on the victim machine only which is the 20
to to go ahead and make some traffic.
So now that we've actually gone ahead and executed something on the client system to show some traffic.
So if we go ahead and see this TCB traffic that came in we can see its destination is one dot one at
its source was one dot twenty two.
So we go and follow that TCB stream.
We can see it sent a secret.
So the secret is password.
Exclamation point.
So this can be used for a lot of different things.
Now you can use this for monitoring Web traffic or gathering credentials that people put into web pages.
So this can be used in a lot of different ways.
And there's other things like air cap that you can work with.
I want you guys to go ahead and test this out on your local machine on your local network.
So you could ask buffet a phone as an example that you might have lying around or your your own personal
cell phone that's on your wireless network.
So go ahead and test it out and check out different ways to do this other than just using wire shark
and spoof.
So try using Ed cap to try to make this all occur.