Welcome back.
Let's cover another tool that we can use for men in the middle attack, and this tool is called similar
to the previous tool from the last video.
This tool is called Aitor QEP Just Without Me.
Now, unlike the previous tool, we already have this preinstalled inside the Linux machine.
And this is a graphical interface tool.
So it might be a little bit easier for us to run it.
And let's give it a try.
What we must do first is we must open the terminal.
And as I already mentioned in the previous video, let's run all of this with good account.
Now, before we actually start running this tour, I want to talk about another thing which is called
Manuell Packet Forwarding.
So sometimes some of the tools will not perform the packet forwarding for you.
And if you don't do it yourself, sometimes even after performing the ARB spoofing and the man in the
middle attack, your targets will not be able to visit pages because you didn't allow packet forwarding
to always make sure that your packet forwarding is allowed.
You can get out the file at location proc slash sis.
Slash net, slash IPV for and slash IP underscore Forbert, once you catch this fall, you will either
have a value of zero or one right here if you have a value of zero.
That means the packet forwarding is not enabled.
And in that case, you must enable it first.
To do that, you can type echo one and you echo it into this location.
So Praksis net IP for and IP underscore forward and then you double check to see whether the value of
one has been added to this file.
And it indeed has.
Now the packets are allowed to be forwarded.
Once you do that, then you can start your tools.
So to start the atter capital, all we need to do is to type Aitor cap.
That's.
It says Atter kept not found, let's give it a try.
Maybe it is not installed by default.
Let me see.
Hmmm, unable to load that cap, maybe it is lower case, so if I type it like this.
OK, so now it works.
Just make sure that you specify it with lowercase at the beginning, then you type at the cap and then
dash capital for graphical interface.
Once you do that, it will open this new window, which is the new version of Aitor Cap that is a little
bit different than in the previous colonics versions.
You can enlarge the window and the first thing that we must do right here is to set up the interface
and display thing at startup so you can turn this on.
You can select your primary interface in case you're over colonics.
It will usually be zero unless you're running over wireless.
Then you want to choose a different interface.
And once you do all of that, you can click on this check button right here.
Which says accept and it will tell you down here started unified sniffing now what they usually like
to do is they like to enlarge this lower window a little bit more to see everything better.
And then we can experiment with different Aitor cap options.
The first thing that we must do once performing this attack is to discover all of the hosts on the network.
To do that, you can type on this button right here.
It will even tell you that this button is used to scan for hosts.
And once you click on this, it would automatically scan all two hundred and fifty five hosts on my
network and it will tell me four hosts added to the host list.
But right here we cannot really see the hosts.
So how can we see which hosts are discovered?
Well, we can go onto this button right here, click on it and it will tell us the IP addresses of the
hosts and their Mac address down here.
Also, these buttons will open the lead hosts at Target one or add to Target two.
And as in the previous video, we're going to perform this attack on our Windows Ten target machine,
or in my case, I'm going to perform on my Windows Ten Target machine.
You can choose whatever machine that you want.
Since the IP address, all my Windows machine is one to took 168 at one seven.
I'm going to right click on this and add to Target.
Want to check out whether I successfully added I can take a look down here and it does say host and
then this IP address added to target one.
But I can also go to these three dots, click on targets and click on current targets and it will tell
me that they have the current target of one or two of the 168.
That one that.
Once I select my targets, I can start AAFP poisoning and to do that, I click on this right here,
which says Mittie menu, and we've got different types of poisoning, but we're interested in this.
Ah, poisoning.
Click on that and click on OK to start sniffing remote connections.
It will tell us down here are poisoning victims, group one, which is the only target that we specify
with its MAC address, and the group, too, will be all of the hosts in the list, but we don't have
any.
So currently we're attacking just the Windows 10 machine.
There is one thing about this tool, it will not print nearly as much information as the previous better
cap tool.
However, once our target visits a page that sends unencrypted usernames and passwords, it will print
that right here.
And we can take a look at that by going to our router, as in the previous video and typing in, for
example, admin and then password if I click on login.
Down here, we will manage to sniff that as we can see the HTP, it will tell us from where did the
connection come from?
The user name is admin and the password is this.
Now, this is once again the hash value of the password, because that is how it is implemented inside
of our router.
If it was some page that was sending the passwords in plain text, we would be able to see it right
here in plain text.
OK, so now that we did the same thing from the previous video, I also want to show you a cool trick
that you can check out to see if the target machine is being spoofed.
So let's say that we are on our target machine and this is the machine that is currently being asked,
how can we check out whether our connection is being sniffed?
Well, we can open the command prompt.
And if we can type the comment, AAFP that pay.
And this will give us our AAFP cash or in other words, this will give us the IP addresses of the machines
in the local area network and their correspondent Mac addresses.
And if we take a look at right here, we can see that all of these IP addresses right here appear to
have the same Mac address.
And that is not a good sign.
Once you see something like this or if you even see two different IP addresses having the same Mac address,
that is also not a good sign.
And that would most likely mean that a man in the middle attack is being performed, especially if you
have an IP address of a router having the same address as a different machine on the network.
And this is how you can check this out, for example, if I stop this.
Let's go right here and quit this program, stopping the Mitt and attack.
And closing this.
And if I go and run the same comment now, you can see different IP addresses have different MAC addresses,
and this is how it should be because the Mac addresses are unique.
So one IP address should have one different Mac address and not like this, where we had all of the
IP addresses having the same Mac address.
Now, in the next video, we're going to take a look at how we can perform this manually using Python
three.
We're not going to be sniffing for data.
We're just going to see how we can change the Mac address of the router from our Linux machine to appear
as the same Mac address from Linux machine to our Windows 10 machine.
Or in other words, if you didn't understand, we're going to spoof the Windows 10 machine with one
packet just to change its ARP tables.
And we're going to do that using Python three.
So that would be about it for the tool.
You can experiment with other options as well if you want to.
And I will see you in the next video.