Instructor: Welcome back.
Let's start with our first tool
that we're going to use to perform
our spoofing and man in the middle attack.
Now for this type of the attack,
there are many tools out there
that you can use to initiate this attack.
Some of them are outdated,
some of them are already pre-installed in Kali Linux.
However, we're going to cover
one of the most known tools, which is called bettercap.
It is a little bit harder to use, however
we are just going to cover the basics of it.
So let's open up our terminal,
and since this tool is not already installed in Kali Linux,
we must install it first.
And my advice would be for this entire section
to run all the tools as a root account.
Now, you might be asking why?
Well, we're going to perform
bunch of different networking things,
and some of the networking things
could require root privileges.
So some of the tools might not run,
some of the settings might not work
if we run it as a regular user inside of our Kali Linux.
So let's real quick
enter the root terminal,
and to install our bettercap tool,
we can simply type the command apt-get,
install, and then bettercap.
Press Enter.
Press Y
once it asks you,
do you want to continue?
And now we're going to wait
for the bettercap installation to finish,
and then we're going to enter its framework,
and perform MITM attack.
Okay, it is finished.
Now, there are two ways we can run this attack.
We can run it as a command
by specifying a file
that contains all of the better cap commands
that we want to run,
or we can run it inside of the framework.
Now for the first try,
we are going to just type better cap to open the framework,
and we're going to experiment with different commands
in order to run this attack.
And then after this we're going to see
how we can run it
just from a terminal in a one line command.
Okay, so once you type bettercap, it's under your terminal
it'll open the bettercap program,
it will tell you which version it is,
and it'll also tell us to type, help
for a list of the commands.
So let's type help to see what options do we have.
And right here we are going to see
bunch of available services
that we can run with bettercap.
Most of these services are not going to run
as it says right here, not running.
And the only one that you will see running is
events.stream.
Now you might totally start to notice
something interesting for us such as for example,
this ARP spoof.
We talked about ARP spoof in the previous video,
and we know that this is the base of
our man in the middle attack.
However, before we get to it,
let's go a little bit up and check out the help manual.
So these are the commands
that we can use with better cap.
We can type, help,
and then some module name
in order to print out more information about
that specific module.
We can also active, quit, sleep
for a certain amount of seconds.
We can set value
the same way that we do inside of
our MSF console.
If you remember, once we set values for certain payloads,
we do that using this command.
So we can assume that this is something similar
as MSF console,
or at least has similar options and commands.
Now let's go down to these modules,
and before we actually get to this arp.spoof module,
let us take a look at this net.probe module.
If I simply just type help,
and then net.probe,
this will give me the help manual,
and the description of this module.
So as it says,
it'll keep probing for new hosts on the network
by sending UDP packets to every possible IP on the subnet.
In other words,
what this module will do is
it'll discover all of the online hosts
inside of our local area network.
So what we can do is we can turn that on
to start network hosts probing in background.
Let's run this command
as it tells us right here,
copy this,
paste it right here,
and let's press enter.
And, we can already see
that it managed to discover some of the hosts
inside of my network.
These are the active IP addresses, right here.
The next thing that we want to do
is we want to type the help menu
for the arp.spoof module.
So just type help arp.spoot and press enter.
And we also get the option as to how we can run this module
but down here we can see some additional options,
or as it says right here, parameters
for this module.
We got arp.spoof.fullduplex,
we got arp.spoof.internal,
arp.spoof.target,
and arp.spoof.whitelist.
In this specific scenario,
we're interested in these two.
So the default duplex and the targets.
The full duplex
if we read the description,
if this is set the true,
both the targets and the gateway will be attacked,
otherwise only the target.
And as it says right here,
if the router has ARP spoofing protections in place,
this will make the attack fail.
So in some networks and on some routers,
this attack will not work
because more and more routers nowadays
are starting to implement the arp spoofing protection.
However, if it is not enabled,
if the protection is not enabled,
then we can perform this attack.
So what we must do is we can type,
set arp.spoof.fullduplex
to be equal to true or just set it to true.
Press enter right here.
And we also want to set the targets.
Now you can specify the entire subnet,
or the entire network,
or you can do it like I'm going to do,
I'm just going to select one target.
And the reason why I'm selecting one target is
because once you run this on the entire network,
there is a lot of information going
inside your terminal,
and it is going really fast
so you don't even get to read it.
Therefore, what I'm going to do for the purposes
of this tutorial is
I'm going to select the IP address of my Windows 10 machine
that we're going to perform the MITM attack on.
And then I'm going to
set arp.spoof.targets
to be equal to that
IP address, just like this.
Once they do this,
I want to start sniffing
for the network connections,
and we can do that.
If I go up here,
we can see that there is a module called
net.sniff.
If I type help net.sniff,
it'll just say that
this will sniff packets from the network.
And the command that we used started is net.sniff.
But before we actually started,
let's go and check out the parameters, right here.
The parameter that we want to use for this attack is
net.sniff.local
As it says, if this is true,
it'll consider packets from
to this computer, otherwise it'll skip them.
Now, once we start the ARP spoof attack,
all of the packets from our target machine
will go to this computer,
therefore this will be able to sniff them.
Let's go with this,
and paste it right here.
And what we want to do is we want to set this to true.
After we get all of these settings ready,
we can type arp.spoof,
and we can set this on,
and we can also type net.sniff on,
press enter
and this will start sniffing packets
on our Windows 10 machine.
We can also see some of the queries
the tower Windows machine is making,
and if I go and try to visit some webpage,
we can see the tower target machine is querying Facebook.
As we can see the desktop machine
initiated the request for www.facebook.com,
and this will work for any other website.
We can see the requests for twitter.com,
and if they were to input a password
to an unencrypted website such as for example, let's say
that they want to connect our router,
and go right here,
and they type for example, test,
and test,
and click on login.
If we scroll a little bit up,
we should manage to find the request
where they send the password,
and here it is.
Here's the request where they send the password
we get the username test,
and the password is a hashed value.
However we manage to get it, nonetheless.
It'll work for any website
that sends unencrypted data, for example,
onto this website called vulnweb.com,
If I go to first link, which is this one,
and I click on login
type username admin and password test,
I click on login.
And for some reason
it seems that it didn't manage to get it.
Let's just scroll a little bit up to see
whether we can find it.
And here it is.
Here is the packet
that we sent including the username and password.
We manage to sniff it from our Windows 10 machine.
Here is the username admin,
and the password test.
Great.
This is one way that you can use Better Cap.
Another way that you can use Better Cap
is if I exit out of this program,
it will automatically start the ARP spoof,
and it'll restore our cashe for our one targets.
And the way that we can run it with the command
is we can just create a file called sniff.cap
and inside of this file we can type
the commands that we typed previously,
which is net.probe on.
We also want to select arp.spoof.fullduplex
to true
in order to also spoof the target and the router.
And we also want to select arp.spoof.target
to the IP address of our target machine.
After that, we set
the net.sniff.local
to true
which means only leave the packages that are coming
from and to this machine.
And then we type arp.spoof on,
and net.spoof on.
These are all the commands that we must run.
So all we need to do is
save this in a file called sniff.cap,
and then we can run the command bettercap -i face.
And -i face stands for interface
where we need to specify the interface of our machine.
Since on Kali Linux,
the only active interface that I have is ETH0.
Once I specify that
all I need to specify is another option
which is -caplet,
and then the name of the file containing our commands.
And this will do everything that we just did automatically.
So if I press enter,
it'll set all of the settings that we did,
and it'll start sniffing for different connections.
For example, if I go right here,
and try to refresh Facebook,
it'll sniff
that request to Facebook.
And this is
one way that we can perform man in the middle attack.
In the next video,
we're going to check out another tool
that will allow us to perform this attack
that you might actually find a little bit easier to use.
So thank you for watching,
and I will see you in the next video.