Hello everybody and welcome to the next section in our ethical hacking course.
Now in the previous section we finished with deep wireless penetration testing section.
And we also before that initially that penetration testing section right now let's see what we can do
after we actually exploit the network itself.
So we saw in the previous section how we can exploit the network or basically hack a Wi-Fi and get into
the local network.
Now let's see what we can do once we are in.
So this is a special section for a certain attack that probably most of you have heard of.
Uh it is one of the most common attacks and one of the most known attacks that there are and it is called
Man in the middle attack.
Now the men in the middle attack basically is the same as it sounds.
It is somewhat interfering with the connection between a victim and the router.
So let me just explain to you before I explain the attack itself we need to learn something about a
certain protocol code called our protocol and our packets.
Now that is a very important thing to learn since it is the fundamental of the of the network discovery.
And also it is the fundamental of the men in the middle attack the understanding the protocol itself
will also help you understand the attack.
So what is the protocol.
Well our protocol basically stands for the our poor solution protocol and it is one of the most simple
ones since it is only used for a discovery of MAC addresses.
For example let's let's see what's my I have config.
So my No.
Pardon me my IP address.
So my IP IP address is one do that 168 that one that for now let's say for example I wanted to communicate
with the router I would have to communicate with its Mac had first.
So what I will do is I would send up an hour packet in order to discover what the MAC address of the
router is.
So the packet would say uh sound something that it would be something like this uh who is 192 that 168
that one that one tell one ninety two that 168 that one that for.
And then the router would respond to me with the answer I am and one ninety two one that the 168 THAT
ONE THAT ONE.
AND THIS IS MY MAC address and then would a process of communication would continue.
Now the all every P.C. there is something called the ARP table or basically where you store the MAC
addresses of the certain devices that are on your local area network for example in order to check the
root of which once reach devices you have stored in your ARP tables on your account in this machine
you can just type here ARP minus 8 and it will show you right here that it only has my router stored
which is normal seen it says right here Gateway the IP address one right to that 168 that one that one
and it gives us its mac address sensitive it performed the ARP request on it.
Now as we can see right here I for example do not have the my main P.C. right here in my card tables.
So let's actually perform.
Let me show you how you can do it.
So let me just open my command prompt and find out the IP address of my main P.C. so you will see the
IP address of my main P.C. is one ninety two that 168 that one but five.
Now in order for me to know to communicate with domain P.C. I would have to find out the MAC address
of it first.
Now we can do that with the ARP request and our request we will automatically be perform if I bring
my mind SBC so ping one or two that one 68 that one that five count and we can specify a count three
and it will ping my main P.C. three times.
And now you will see if I run out minus say again I will have two devices right here as we can see I
also now have one night to that 168 at one at five and I also have the MAC address of my windows P.C.
we got it since the ICMP request or the ping request actually had to perform the ARP request first in
order to find out what is the MAC address of my windows P.C. in order to send the ping requests that
is a simple idea behind the ARP request.
Now there is also there are two things about the AAP.
They are our requests and our responses are our requests are basically something you send to our outer
for example as they said who is and the AAP reply starts with my I am or the debt my IP address is located
at that MAC address.
So let me just show you if we open up our white shark we should be able to see some our progress flowing
around.
Maybe you will understand it better and after that I will also show you the contents of the our request
in a Skippy which is a python library.
So let me just open this and we can feel throughout our.
At the beginning.
So let's just wait for some or we do not need to wait.
Let us just being something or no I need to open a new terminal since this is Terminal 4 why a shark
and let us try to pin one wanted to that 168 that won that fight.
I will not give us the opera responses since we already have.
Oh never mind.
But this is not OK.
So it did give us the our responses even though we had it in the ark tables.
We can have it right here.
Let us just close this.
This is enough.
You can see that this simple concept of the Ark protocol is this.
So we send to the uh to the broadcast Mecca to the broadcast MAC address so to everyone we send a question
who has 192 that 168 that one therefore tell 192 that 168 that one but five or basically let me just
check this.
This is reverse.
So one idea to the 168 that one that 5 is my window specie and that 4 is our cleanest machine.
So OK.
So this request right here was performed by our Windows machine as we can see who has and then the IP
address of the clinic's machine and tell the IP address of our Windows 10 machine.
So this was a package that was sent by our Windows 10 machine to be broadcast address so everyone on
the local area network received this packet.
And the one that no the MAC address of the clinic's machine will respond.
And the response comes from basically us.
It can also come from the router as we can see right here my night to that 168.
That one that 4 is at this MAC address and this is an ARP response.
This is the same thing.
Just reverse.
So here we we are asking as a Kleenex machine we are asking who is the to stand.
And here is the reply we understand is at this MAC address.
So those are just basic concept of the our requests and our replies
so we will just close this with without saving OK.
And now let me show you something else.
Let me just enlarge this so we zoom it in and if you type your escapee in your Kleenex it will open
up something uh some kind of a python library.
Basically we will cover it later on for now and just type here Alice and then art and you will see the
contents of the ARP packet.
Now you do not care about most of these or actually you care about.
Around half of these so the O.P. right here stands for either request or reply no one will be set to
request the number two will be set to reply.
You can see that in the art packet there is a specified the source IP field and the IP field of the
destination.
So basically source IP field would be our IP address and the IP field for the destination would be the
targets IP address.
So let's say I want to perform an art packet that asks for the IP field or for the death for the mac
address of our author.
I would specify my my mac address right here and I will specify the writers I IP address right here
in the IP destination address.
We also need to specify our mac address and the destination MAC address which we will be of which we
will be receiving.
So we specify our mac address so that we can get the reply.
And in the destination MAC address we will get the answer of what MAC addresses stored at that IP address
that we are searching for so that is basically the simple concept of the art protocol.
Now you might be asking.
Let me just close this.
You might be asking why am I showing you all this.
Well it is the as I said it is the fundamental of demand in the middle attack as the all man in the
middle tax base.
We start with the R spoofing and what is ARB spoofing.
I will talk about in the next lecture.
Uh I just wanted to give you a brief overview of what our protocol is.
If you want to you can search a little bit more about it and read on it.
It's really not that hard to understand it especially once we run this attack in practical you will
understand it even more so let me just finish editorialized here and in the next one hour in theory
explain what the attack will be that we will perform which is amendment or attack.
So I hope I see you there and take care by.