OK, welcome to the man in the middle section.
This is where we can relax a little bit since we covered all the important things that an ethical hacker
must know from scanning from exploitation to gaining access with Trojans and Web application penetration
testing.
Now we can lay back and cover something that you won't need that much.
But it is a cool attack that allows you to sniff information inside of a local area network.
Now, in network penetration testing, this is something that you also want to try in some networks,
there will be protection that blocks these type of attacks.
However, to this date, many home networks, schools and company networks don't have this applied anyway
before we actually get to run this type of the attack.
Let's first talk about how does it work?
Let's start like this now imagine a home network with many devices say we have two computers and also
our Caledonius machine inside of that network networks also have routers that routed traffic to different
websites.
And every time you, for example, communicate with a Web page, you do that through your after you
request a Web page and a router will forward your request to that server.
And when the server sends a response to you, the router will send it to your machine inside of the
network.
But how does it know which machine to send to?
How does it know to whom to forward which packet?
Well, let's explain it like this, let's go back to our three machines and let's mark them with A,
B and C.
All of these machines, including our routers, also have an IP address, so we can say a has one or
two the 168 that one to 10 be has one right to that 168, that one that five hour Linux machine has
190, that 168, that one that seven.
And our router has 192.
That 168.
That one.
Besides having an IP address, all of these machines also have their Mac address and these to help them
communicate with each other over the network, our router knows how to forward the packets to thanks
to our packets and our tables.
Now, we're going to talk about our packets in just a second.
But what I want to mention for now is that our router has our tables that map every IP address inside
of the network with their MAC addresses.
Then it uses the machines Mac address to forward the packet to them.
We know by now that Mac addresses are unique, therefore by knowing them, you know, the idea of that
machine and then you can communicate with that machine.
Now, let's explain.
Those are packets.
What are they and how they allow us to communicate with each other?
Well, to explain this, I will remove one machine just for the simplicity.
OK, so there are two types of our packets.
We have our requests and ARP replies or our responses.
Now with requests, we find out what machine has, what Mac address, and with our replies we reply
to that machine that ask the question with our response request would look something like this.
Let's say Machine A wants to communicate with our Linux machine.
To do that, it must know our Mac address.
So it sends the our request to the broadcast address, which simply means every machine on the network
will get that our request.
And with that our request.
The Machine A asks who has an IP address or one to that 168.
That one that seven.
And it tells send me your address if this is your IP address.
In this scenario, our Linux machine receives the request and it gives an answer.
It says, I want to add to the 168 that one, that seven.
And here is my Mac address.
Now, this is just normal communication in any network.
This is how machines and our router figures out to who they should forward a certain packet.
However, there are ways that this can be abused.
For example, what if I from my Linux machine craft and our response and send it to Machine A saying
that I am one to that one state.
That one, that one, which is the router, if we know that machine, a user's router to communicate
with the Internet.
Therefore, once we send the machine and our response and tell it that we have an IP address of the
router, it will start sending its packets to us instead of the router.
For example, let's say Machine A wants to visit Facebook, in this case, it would send that Facebook
request to us instead of directly sending it to the real router.
Well, you might be asking what now?
We just managed to redirect the traffic of machine to go to us.
And now that machine won't be able to access Internet because the packets are not being forwarded to
Facebook or any other page that they want to visit.
Well, not exactly.
We can also send and our response to the router in this response, we tell the router that we are the
machine AI now, machine AI believes that we are the router and router believes that we are machine
A.
All we are left to do in this case is forward the packets to keep the connection going.
So in this scenario, instead of communication websites going like this.
Instead, we proved the network and now the communication is being done like this.
In this case, if Machine eight tries to visit Facebook dot com, for example, it will send that request
to us, which we then forwarded to the router and router forwarded to Facebook like this, we can sniff
the data if it is unencrypted and we can also see what websites is machine a visiting.
And this communication works both ways.
Once Facebook receives machines a request, it sends the response that comes to our router.
And then since Trotter is also being spoofed, it thinks that we are machine AI and it sends back the
response to us.
Then we forward the response to machine, a snow machine A has no idea that it is being spoofed since
it is able to visit any pages and websites.
This attack is called Man in the Middle with the help of our spoofing.
And of course, when we perform this attack and we spoof our router and targets there, our tables will
look something like this.
The Mac Kagiso machine, a changes to our Mac address inside of the routers are taped and that is while
it's being spoofed.
Once we stopped spoofing, the Mac address changes back to its real Mac address.
OK, great.
Now that we know how exactly the attack works, let's mention a few things that we might want to get
once performing this attack.
The goal of it would most likely be to overall be able to save the data going from other machines on
the same network.
We also want to be able to check out what websites are other machines visiting and if possible, in
case some communication is not encrypted.
We would want to save passwords if someone tries to login to some page.
Just most of these things depend on which websites are they visiting.
Nonetheless, now that we know theory behind the attack, let's see how we can perform it using different
tools.
The next video.