Right now, it's time to start the Reinach know the first thing, make sure that your machines are active
and running and don't forget that then it must be bridged.
So from here, make sure it is bridged and make sure you choose the exact interface that you have.
All right.
So this is the door and this is for the county, which is the idiot machine, the hacking machine.
It is Broadbridge as well right now.
Open it now.
Here is the open machine.
Now, I actually make sure that the torch is running and active through the Swadesh actually to go as
an adult user toward one, two, three, one, two, three.
Yeah.
If there is here.
Right.
Yeah.
Cool.
Now system sitel status actually lets.
I actually I want, yeah, to increase the font size system to the start datastore.
Yeah, it is running, but it's better to restart it actually to make sure everything is working as
expected.
The same thing for Ingenix.
Right now, let's run this tool or this Mid-State Dash NCLB.
Yeah, you can see it is not here, so let's install it now, we have this to us as Dutch NTSB so you
can see that, yeah, it is running on board 80, which is the engine.
And here on this board, we have the tour, by the way, sorry about this, because actually this is
better.
I think.
So you can see that here it is, the door where it is.
Yeah.
Here it is.
The use of this photo here.
All right, what is running low on this board?
All right, cool.
So we are running now, actually.
Let's go to that Etsy store or actually Etsy store.
It is Bar Lip Tor Hidden Services.
And inside it, we have the hosting.
So let's go to hostname.
This could be it.
And it's open to our browser.
And actually I download it here in the downloads.
Here it is.
So I will go to it and he'll open the terminal here and it's the start.
The name of their browser, which is a manuscript, by the way, Orshansky, Lizzi.
So here it is, an open.
In a moment, yeah, here it is, you can see that it is now running now in its base that to see if
it is working or not.
Right now you can see that, yeah, it is running successfully.
Now you can see that to our website.
Here are some disgusting content or whatever that child -- website that Illiad captured.
All right.
Now, here it is.
OK.
All right.
Cool.
Now, let's clear the screen and let's go to another machine, which is the next machine now here,
if you open the Terramin, then.
Like this.
So actually, let's increase the font size, so actually, if I thought if I have config, you can see
that here is the IP address.
Which is, as you can see, the is one two one nine two one six eight eight and one one three four eight
one one, two, three.
But here, actually, if I thought I have conflict like this, you can see that here it is, eight one
one a four, which is at the same subnet or the same network.
OK, cool.
Which means that we are having the total website on the same bandwidth as in the show this year that
our website on Rollin's Cuppy network or bandwidth.
All right.
So we are ready to go.
So from here, actually, the first thing we want to make the man in the middle ATEC.
So for that we will use the technique.
Our people think, OK.
And for that, the tool we will use actually to go through the Soudas, so which is Aleut one, two,
three, one, two, three, or actually just Aleut or not.
Now we will use the tool called it.
OK, so you can see that it cap like this.
And if I meant it so he would open the manual.
This is a multipurpose sniffer content filter for men in the middle attacks.
Right now there are a lot of tools for men, limited attacks, by the way.
They are spoofing manumitted framework.
A lot of things actually.
You can read more, but this one is good.
So for it, we would use that Dashty option, which is the text only interface, as you can see.
Also, we will use the dash M capital and the M here.
It actually is the man in the middle attack, as you can see, dash and or dash, dash and ITM, which
is men in the immediate attack.
And for that we will use up OK, which is this one.
Right.
And we will use the remote.
So by the way, you can read more about this tool, what is remote, which is one way, but briefly
remote, which is two way.
One way, which is one way.
All right.
So from this I.B. to this I.B. or from as one direction or multidirectional, OK, don't worry, we
will handle it.
Now, the first thing, it's a cat and then dash t, which means text.
And as a verbose that's either in the Ethernet or the interface actually.
And how to do that.
Just like I have config and you can see that here, the Ethernet or that interface I'm using is ETEC.
So it's on its own.
And by the way, this is inside the virtual box.
OK, so I will use it.
And here we will lose.
Dash M Capital, as we learned previously, are like this and we will choose the remote.
OK, no remote here.
We would provide the first IP address, as you can see here, and then the second IP address.
OK.
All right.
Now the first IP address, which is the IP address of the network or of the drought, are actually know
how to know about it.
Now, remember an idiot actually connected to that Rollin's coffee, so and Brauns coffee access point
or the switch will have the DCB protocol enabled.
So it would give him an IP as well as we would understand that this is that the network and here is
the subnet for it.
So we understand that these are the network baat and these are their hosts.
But so most likely it will be one nine two one six eight eight to one.
All right, cool.
And to know the IP address of the network, we will use that about woman and I would Dushan and you
can see that the gateway we are going to watch is this one.
If you notice here, this one is the same as this one as is something that this first part, which is
the network.
So actually let's increase the font size.
So here one nine two one six eight eight.
Here it is, one nine two one six eight today to one, which is this is the gateway or the Ebe of the
left.
So from here I would put it OK.
And what slash.
Slash then slash that I.B. of the victim.
OK, which is the I.B. of that war machine.
Cool, which is this one?
OK.
Or one, two, three, one, two, three, no, you may ask me, but I don't have access on this tour
machine.
How should I know it?
All right.
It's OK.
I got you.
So if I.
I have conflict.
This is the.
I believe it.
All right.
But how should I know this is the EBE for this specific machine.
All right.
For that we would use a tool called Discover.
OK, so actually let's go pseudo sue dash to go as a route user idiot user.
So here we will have a command called Net Discover, OK, like this and if I type into it will start
scanning all the Ibbs inside the network.
So give it sometimes until we got the I.D., ok.
Now after a time you I got these.
Ibbs So this is the IP of that doctor.
You can see how you can do whatever.
Here is one of the clients.
Interconnect, cooperate, whatever.
Here is another plant which is BKS and system whatever.
How idiot knows that this is the IP for this machine.
Actually he, he, he will try getting it OK.
And actually it took him a lot of times to detect if there are a lot of clients, what are the claims.
Today he came to the cafe and a lot of times actually and they start scanning until he reach to the
conclusion that this is the IP of this store server.
OK, so I can stop it right now and I can take this IP.
So let's make sure that it's one one four.
Actually, if I go here.
Yeah, it is 114000 which is the same one right now actually.
Remember this virtual machine.
This one.
The candy machine is completely separate from the example by the way, because we are using a virtual
machine.
So how did I know that?
Because they are in the same network and using the Discover tool, we discovered that this is the IP
of the machine.
All right.
Now we need to copy it.
And it's what it's here.
And again, the same syntax, which is Síochána.
So the syntax would be like this it acap again, a quick recap here.
We lose the command, which is Ithaka, Dashti Capitán, which means text or verbose.
That's either interface, which is at zero that I'm using on Linux, on my checking machine, Desh Cavitat,
which means many of them did a deck and the technique would be up with the remote and the difference
between remote and one way, which means remote, which which means that we would send Tropica and intercept
the traffic between this I.B. and this I.B. and we would send the traffic between them not as a one
way as a bidirectional right.
Which means from this to this and from this to this.
All right.
And this is the IP of that gateway or the router or the switch in our topology, and this is the IP
of the Tor machine.
How did we know about this?
We used that discover tool and we found it here.
Now, it is not as simple as that because there are imagine we have 10 or 15 client that are connected
to the network.
So actually it took him a lot of time, maybe one month, maybe two or three months.
I don't know, actually, until he discovered that this is the IP or this is the static IP.
So the first day he found that there are 10 or 20 IP and the other day they are another Ibbs and he
made a list, OK, but the IP he found and he found out that this IP keeps going over and over and then
his teammate.
So he assumed that this is the idea of the machine.
So he would start doing it.
So actually before that, he will start intercepting the traffic.
Right now, by doing that, I will start intercepting the traffic.
And doing Mendham, again, I want you to do that to help others, please do it to defend yourself or
your business cafe or whatever, OK, from such attacks.
All right, Bressington.
Now you can see that it will start showing.
So we are actually we are starting intercepting the traffic and so on.
So this is the first step right now.
If I go here, actually, if I open the browser, which is total website, if I appreciate and it is
open.
So if I go ahead, actually it got that and intercepted here through our network, through our network
card.
So it's time to start sniffing that traffic now here to intercept the traffic.
Now it's time to start to sniffing that topic.
How to do that?
Actually we will use Sudo Wireshark, OK, or open the way from here.
OK, it's OK.
But I prefer to run it as a rule actually like this one.
Now we will choose the atrophic interface for the inter network interface, which is zero, and it actually
is the network interface that we are running the attack on or that we are intercepting the traffic man
in the middle of that.
All right.
So we will choose it.
And from here, we will start intercepting everything.
So actually there are a lot of information, a lot of data and so on now actually, how do you detect
at our website?
OK, now the first thing there are a lot of methods are way to detect at our website.
The first thing using the tote board number by default, the door.
What number is the TCBY?
The board after I'm using the filter here.
Equal, equal.
Nine thousand and one.
OK, yeah, we got it.
OK, from our first try we got that they are at our website running until December.
OK, now how actually did I know this is the different board number for our website.
Now actually it's not from me.
I just read about it.
This is the default board number.
How it is that board at the different for HDB.
This is the default board for simple.
Now this is one of the way to detect at all website.
Now some people change this default because they want to make it very hard to capture the traffic or
capture.
There is a total website running, so they change this default board to something else.
So we cannot use this method.
We need another method.
And what is the method?
Actually, by typing the Ibbs right now, remember, from the topology, from the theory site, from
Tau or how Tor works, that we mentioned that there are exit nodes or in regards.
Right.
And we have a public Ibbs available.
All right.
Now, if we have a list of the known public IPS for the entry guards or the exits nodes and compare
here, then we can find it and you can see that this is the EBE, you can see that.
So if I remove this so let's remove this filter so you can see that there are a lot of traffic right
now.
I am intercepting that the source is coming from this and going to this arbitrary destination, public
IP address.
OK.
And the protocol is DNS, whatever.
OK, so for the source IP, I know that this is the IP of that or machine.
We saw that a two to one one four.
We saw that.
Now the destination.
What is this IP address?
All right.
So I want to make sure that this IP is not one of the entry or exit nodes.
OK, so if it is one of these so we make sure that this is at our website, so we are communicating
or this tor up the open to see.
I mean this one is communicating with at our website and he got the connection from an exit node or
whatever.
OK, now by the way, I used the term browser or tor client from the same machine, so if I have it
from another machine it is OK.
It would be the same actually OK, because we got connection through our network from some IP address
through this.
So either it is coming from the same network.
Performance could be or it is coming from a network from outside cuffy through the Internet, as we
saw previously.
OK, it's OK.
It is the same after either running or seeing if it is a TCBY brought on board, nine thousand and one.
Or we can see that there are some public Ibbs ads, as you can see that there are some public IP address
and you need to start checking these public IP addresses for that.
Actually, I provided you with these links.
Actually, I got this from the official documentation, the relationship.
We already know that the relay or the n internet work are running as a volunteer around the world.
Right.
So some of these back people are using these relays or this not as Tigard or as exit nodes.
OK, so we would assume that in the show that the Tor website was using one of these nodes, OK, from
these and in it he captured this.
So actually, let's take this IP, for example.
So actually, if we have this IP address, which is this one.
OK, so let's search about it to one night.
OK, now you can see that it is not here.
OK, now let's find here in the intriguer.
So this is for then triggered, by the way, as you can see, the search is also for the exit.
Go for the exit, not the flag.
Is exit here for the entry guard or the guards.
So if I found it here, if I search about it here.
Oh, you can see we found it.
So which means that this IP address is used as a got where it is here it is here as regard or guard,
which means that, yeah, this strophic where it is here, here it is that this means that this IP address,
which is the IP address of TOR, is contacting an entry guard or exit node with this public IP address.
We assume now that 90 percent or more actually let's say it is 97 percent.
We are seeing Tor traffic.
OK, by the way, we already assumed that by seeing the TCBY bot, which is nine thousand one, we already
saw that.
But imagine if that the default would have has been changed.
OK, so this is the other way, which is by looking or by searching for the public IP we are talking
to.
So the public IP of the entry guard or the exit node, we found it here.
We search about it here.
And I bravado, by the way, with these things.
And actually you can search it here from the official documentation or the official website.
And we noticed or we know that this is our total Web site that are running on this specific what?
OK, no, not specific here on this specific IBE, because this IP is the idea of the Tor server itself.
Right, because we are running that our client or Tor browser from the same server or to Portugal.
Now we noticed that this is the IP of the server that are coming or going to this one.
So we came with the conclusion this IP is the IP of the server, that we are contacting an exit node
or in Tigard, whatever, which is used in the Tor network.
So we would assume that this IP address is the IP actually subnet.
So we would assume that this IP address is the IP address of that Tor server or maybe client.
I don't know.
Actually we don't know.
So how to do make sure we will start scanning this IP address.
So actually let's stop that by typing concurrency.
All right, we don't need to intercept anyone.
OK, let's good from this, it's from the Cairney, from that Wireshark squid, and we don't need it
anymore.
Now we assume that this is the IP address, which is this one one six eight eight one one four.
This is the IP address of this suspicious Tor said about maybe Torsella or maybe not how to make sure
we will start using the N map utility or tool so unmap to start scanning, so unmap this IP address
and you can see that it will show us only the board eight thousand because by default this is the first
one thousand.
So let's type this time dash B dash to scan all the bots and just give it some time because the bot
nine thousand is not within the first 1000.
By the way, you can see Nachshon nine nine nine goes right now.
You can see that even though we scan everything, as you can see all board, so you can see that all
the boards are closed.
Now why the board nine thousand one is not opened here?
Because if you noticed here in the top tier.
Yeah, I know we don't have access yet on the server, but we already we already know the technology.
So from here, actually, if you go to that then etsi tor RC or torturously.
You can see that if I go to that.
Now, something where it is, yeah, the hidden service dial, you can see that it is 80 on the localhost,
80, right.
So here it is.
So you can see that it is running locally.
So you can see that.
Here it is.
So the board that are running 9000, you can change it, by the way.
OK.
So we didn't know by that, actually, we made sure that here it is running on board.
So this is HDTV service, Ingenix.
And why we use it, why we use that on board nine thousand one.
OK, so you can see that it is on this IP address and on this nine thousand what?
Which means that, yeah, it is at our website 100 percent on this idea.
All right.
Now, here's the part of how to hack the machine.
Now, actually hacking to our website or to our exit node is very hard.
So how is it managed to hack this specific server?
No, they didn't give much details about how he hacked it, but maybe he found some vulnerability on
this machine.
OK, so maybe he was able to access it through the network.
As you can see, because it is, what, 80, so our you can find there are a bug or vulnerability running
in this server and he compromised the system by that.
But from the day he said that he is the one in control of the exit node, which makes me the one on
control.
So from this day on, we understand that he compromised not the talks, but he compromised the exit
node, which is actually harder than compromising the server itself.
So if he said that, yeah, we noticed that the server and the same network and I I scanned it, I found
there are some vulnerability and start hacking it, though this is a battle.
But he said that, no, he compromised the exit.
Not that referring to this machine.
No how to compromise at our exit nodes or into.
Actually it's very hard.
You need to compromise almost 90 percent of their power relay networks around the world.
And then you will start capturing the traffic on each one and then you can detect that it is going to
turn on Ron's coffee and this what makes it hard.
So this is just for the show.
This is nuttery one had to be honest.
So theoretically, it is possible.
But actually it it takes a lot of dedication, effort, time.
And on top of that, you need a lot of luck, actually, actually 90 percent.
You need that to be honest, because from the theory I showed you, that using the relay or choosing
the circuit for this TOR network, it requires randomisation.
And to know exactly that there's traffic going from this place to this server is very hard.
So how he managed to do that, I didn't know, actually.
But I think this is for the sake of the show.
After all, they need some drama, right.
By the way, I provided you the method how to hack at our website, the ways to hack a website to our
website when it sounds insane or impossible, let's say hard, but just as a theory.
But OK, so we will assume that actually to be a real life, that in the term and runs cuppy, the torch
server is exist and here it is, the IP address of it.
And he managed to find a vulnerability here inside this server and he start hacking it and he managed
to hack it by exploiting that vulnerability and which is clearly they didn't show us and they didn't
give much details about it.
All right.
Thanks for watching.