1
00:00:00,300 --> 00:00:07,020
In this lesson, we will talk about ERP spoofing and ERP poisoning and will perform a practical.

2
00:00:07,320 --> 00:00:13,500
So ERP stands for address resolution protocol and spoofing means redirection of network.

3
00:00:14,010 --> 00:00:14,580
Right.

4
00:00:14,850 --> 00:00:23,460
So this is the scene where this is our target which is running Windows ten and its router, right?

5
00:00:23,460 --> 00:00:29,580
So Target is communicating with the router in order to access Internet and other resources.

6
00:00:30,180 --> 00:00:35,280
Now we are here right running Kali Linux.

7
00:00:35,790 --> 00:00:41,700
So we told this target, our target that hey, I am your router.

8
00:00:42,990 --> 00:00:47,610
So in order to access resources you have to send request to me.

9
00:00:49,470 --> 00:00:49,950
Right.

10
00:00:50,310 --> 00:00:56,640
And in ERP poisoning, we are using my team and my team stands for man in the Middle Attack.

11
00:00:56,670 --> 00:01:00,480
So we are acting as a man in the middle between these two.

12
00:01:01,290 --> 00:01:01,890
Right.

13
00:01:01,890 --> 00:01:10,170
So we are telling Rooter that, hey, if you want to reply back for any request, then you have to reply

14
00:01:10,170 --> 00:01:12,480
back to me, right?

15
00:01:12,900 --> 00:01:17,340
And then we will reply back to our target.

16
00:01:18,540 --> 00:01:22,320
So we are acting as men in the middle, right?

17
00:01:22,890 --> 00:01:26,280
So let's see how to do this in practical.

18
00:01:27,540 --> 00:01:33,540
So here is our colleague, which is an attacker machine and we will start with ARP spoofing first.

19
00:01:33,540 --> 00:01:38,670
So ARP spoof hyphen I hyphen is for interface.

20
00:01:38,670 --> 00:01:41,160
Interface would be zero.

21
00:01:41,670 --> 00:01:50,580
Right now, guys, we are actually acting as a man in the middle and we will capture all of the network

22
00:01:50,580 --> 00:01:54,450
packets using a sniffing tool called Wireshark.

23
00:01:54,840 --> 00:01:55,350
Right.

24
00:01:56,100 --> 00:02:01,980
Whether it is a wired network or a wireless network, we are able to capture all of the packets.

25
00:02:04,380 --> 00:02:15,030
So interface it is zero hyphen T for target and then IP off window ten which is ten .0.2.7.

26
00:02:15,030 --> 00:02:24,420
And then the IP of router which is ten .2.30.2.1.

27
00:02:26,050 --> 00:02:26,590
Then.

28
00:02:27,760 --> 00:02:30,730
Now it says ERP reply to this.

29
00:02:33,250 --> 00:02:37,460
Now let's open a new terminal and let's do vice versa.

30
00:02:37,480 --> 00:02:39,190
So AARP spoof.

31
00:02:41,030 --> 00:02:42,520
AARP spoof.

32
00:02:46,350 --> 00:02:49,050
Hyphen eye for interface again it has zero.

33
00:02:49,620 --> 00:02:51,360
Then hyphen t that is your target.

34
00:02:52,560 --> 00:03:01,170
This time target is a router, so router ip and then windows ten IP.

35
00:03:05,960 --> 00:03:07,820
Now let's open one more terminal.

36
00:03:10,330 --> 00:03:12,190
And Type B sniff.

37
00:03:12,820 --> 00:03:14,950
So it says listening on its zero.

38
00:03:15,400 --> 00:03:16,120
Well, good.

39
00:03:16,600 --> 00:03:20,590
Now let's open new terminal and let's open Wireshark.

40
00:03:26,010 --> 00:03:26,180
Click.

41
00:03:26,300 --> 00:03:26,850
Okay.

42
00:03:31,070 --> 00:03:31,570
Again.

43
00:03:31,580 --> 00:03:32,300
Okay.

44
00:03:33,770 --> 00:03:39,980
Now here, select the interface, which is zero in our case and click on Start.

45
00:03:40,310 --> 00:03:45,140
So Wireshark has started capturing packets, right?

46
00:03:47,920 --> 00:03:52,690
So here are all the requests made in our network.

47
00:03:54,420 --> 00:03:54,900
Right.

48
00:03:55,170 --> 00:03:58,560
So this is how ERP spoofing actually works.

49
00:04:00,060 --> 00:04:02,260
And you can see that it's capturing on protocol.

50
00:04:02,300 --> 00:04:07,350
AARP, this is the time source and destination.

51
00:04:07,710 --> 00:04:08,310
Right.

52
00:04:10,470 --> 00:04:16,020
And these are the other information right now.

53
00:04:16,230 --> 00:04:18,870
There is one more thing we have to do.

54
00:04:18,900 --> 00:04:29,940
Let's minimize this and let's open a new terminal and we have to forward our port for IP version four.

55
00:04:31,380 --> 00:04:36,990
So this ctrl hyphen w.

56
00:04:39,450 --> 00:04:42,630
Net dot IP version four.

57
00:04:45,930 --> 00:04:52,400
Dart IP forward is equal to one.

58
00:04:52,410 --> 00:04:58,470
One is used to enable IP forwarding hit enter done.

59
00:04:58,590 --> 00:05:01,650
So this is the complete process of ERP spoofing.