OK, so another attack that you actually do when you conducting your test on a network is actually arms
spoofing and you have to be on the same network as those, of course.
So our stands for address and protocol.
And that pretty much allows computers to associate, you know, Mac addresses with IP addresses on the
network.
So this is how computers on an Internet work typically know who each other are.
And using our spoofing, you can actually impersonate another computer and potentially, you know,
intercept information like credentials that would go somewhere else.
So let's go ahead and check out a quick example of how we can do some movement.
OK, guys, so I'm back of my politics machine.
So what we're going to do is we're going to do an arm spoofing attack.
So you're not sure AAP stands for adverse resolution protocol?
This is pretty much how the networks map IP addresses to America.
So how network the computers on a local network know who each other are?
So what we're going to do is we're going to act like we're the router and intercept traffic that's going
to our target device.
So we can do this with an application called AACAP.
So you can start better just by opening up a terminal.
You have to avoid it as route.
So you're going to want to do pseudo.
So pseudo better cat.
And then you want to do Dashi face and then we're going to do the interface.
So I'm using my wireless network card attached to my Linux machine, whatever, how to install that
before it.
So just I phase in zero and they just hit enter and that is going to start up.
So you're going to see right here, it shows us the subnet that we're on that it also shows our IP address.
So this is my IP address on the network that I have locally here.
So what we're going to do when you first get in here, you can just pretty much just taman help and
it will show you all the different modules that are available to us.
So what we're going to be using is the AAFP spoof module.
So now you can look into these other ones that we're going to talk about, some of the other ones as
well.
But right now, we're just going to look at sort of our spoof module.
So if you ever want to just know more about the module or what's inside of it, you just do help in
the Narmada module name.
So you can't just help our spoof and then it's just going to show you some different stuff.
So this is how you turn on used to do a spoof on.
And then if you want to, you know, turn it off, you just turn it off in the same type of manner and
then sell you the parameters down here.
So we're going to want to set these.
So this one right here is our spoof, that full duplex.
So this is going to do it means it's going to attack both the target and the gateway.
In my experience, I've had more success having this.
Just kept this false.
That'd be fun.
But you said that is true as well.
But if your router does have some spoofing protection, it might cause issues and you also can mess
with the network as well.
So just be careful.
And then also we're going to set the spoofed targets one, and that's just the target address.
So for here is going to be my Windows time machine here.
So just open up a command prompt IP config and for my local network, my IP address here to do this
is one nine two one six eight one two two six.
This is my address.
So just remember that.
So also just see you guys.
See, we're going to do a Ardeche a command and this going to show pretty much all the mappings that
my computer is aware of right now for this local network.
So it sees the router right now for this interface on my Wi-Fi interface for my laptop, one or two,
two one six eight, one down one.
That is my router.
And this is the Mac address that it has for right now.
So just remember that.
And then also what we're going to do is we're going to paying our colonics machine just so that it can
actually put it into its ARP table.
So let's see.
So now it knows what it is.
So now we're going to do Arpey again and we're going to scroll up to that interface.
And now you see that 19 this is the Mac address for my colonics interface.
So we can also confirm that over here if we just do pseudo RF config, super secret password.
And then we've got to look at Thailand zero, so you see, this is the IP address that we see in Better
Cap, and then you can see that this is the exact same Mac address as we pulled up there.
So now what is the machine knows that this is us and it knows what the router is.
So now what we're going to do is we're going to do go through and do our spoof stuff.
So what we want to do right now is we can just go when you want to set the different parameters inside
of module's, you should do set.
So we're going to do our spoof.
Targets, we're going to keep the full duplex as normal, we'll just keep it as false.
That doesn't mean we do.
In my experience, so we set our targets one or two, that one six eight down one to two to six.
And that is for my Windows laptop.
So bam.
And then what we can do is actually turn on the net sniff module as well.
So let us sniff.
And this is apparently going to sniff traffic on the network and look out for different things.
And we can also another one that we could turn on is not dog recon.
And this is going to also look out for different things on network.
So we just turn that on.
And it's actually already running because we turn on an advanced module, and if you ever want to see,
like what modules are running, you just type in help.
So actually, we are and it doesn't have any record.
And there's another one called Nektar Probe.
It'll look around to see what's in that.
So we need that probe.
And put that on, so it's going to look around.
CDC is detecting IP addresses and seeing what the Mac address is and then it'll put it in this nice
little table.
So let us show and show us a nice little table of everything.
Has the different devices that are on my network right now and the Mac addresses.
So back to the spoof.
So we set that where we set our target.
So now we can just turn it on.
And so our got spoof and then on and now we're spoofing.
So it should be pretty instantaneous because right now our machine is sending out a bunch of requests
for a responsible budget request to our Windows laptop and is going to tell us, hey, you know, this
is the address, this is the magnetosphere about it.
So what we can do is actually go back to here and we could do another Ardeche A.
And what we're going to see.
Is that right now?
So remember, the one time 19 was our colonics machine.
So now what was before?
The router is now showing the exact same Mac address for callisthenics machine.
So now this Windows machine thinks that our Linux machine is the router.
So that means that everything that everything gets sent from the Windows laptop is going to come through
our Linux machine.
So that means that we can literally control kind of like what happens with their network traffic in
a way.
So that is pretty much how you are spoofed.
So the next thing that we're going to do is actually do a DNS spoof and be able to for the traffic to
a site that we want.
So we're going to take their requests and actually send it to a website that we create on our own that
we're hosting on account of the next machine.
And that's going to be based on what domain they try to go to.
So let's go ahead and try that.
OK, so we're back in America.
So what we're going to do is a DNS spoof, like I said before.
So enable to do this.
First of all, we need to make sure that we have Apache running and that we have some files on our account
of the next machine.
So before we do anything, just clear my screen here.
So there's a service called Apache.
Apache allows you to run websites and it's installed by default on your colonics machine.
And all you have to do is add in pseudo servers, Apache to and then start and then it'll start at the
Apache service.
So now you have Linux turning to Web server.
So if we were to go to a Web browser and really quickly just inside of Linux.
We can just type in localhost in the address bar, just give me a second, then load up so we can just
type in like localhost in the address bar localhost, and it should pull up this page right here.
So I have a I have a website I kind of made.
I'm going to give you guys the files.
But this is well, it's like a simple login screen, just like I like a proof of concept.
So the file that gets loaded when you load, localhost or load your holiday Linux's IP address over
80 when Apache's running is located and Vaslav WDW a.m. but to me there a and this stuff is in here.
So I'm going to give you guys first.
We're going to look at this index e-mail that's was loaded up here right now in Mozilla, Firefox.
So this is just a simple login form.
And what is going to to do is go ahead and look at that actually.
So V for w e html indexed e-mail.
So this is the e-mail code is pretty basic.
So the code that you see right here is for the form and what happens like right here was this form action.
So it pretty much takes the information func login form it loads of this action page type form and then
it's going to do the actions inside of that.
So what we're going to do right now is we're going to force our target machine to visit this page instead
of what they were expecting.
And we're going to do that via DNS spoofing.
So what you're going to need to do is take the take the files that are located in the resources and
paste it into this directory.
You're going to paste into this directory right here or you're going to paste it into the VA demidov
w e-mail directory and then you should be good to go.
So what we can do is go back to better time now that we have that set up.
When she pays that stuff in there, you can start Apache and you'll be good to go.
So what we can do now is the DNS spoof.
So once again, if you ever need to know something about a module, just type and help the DNS spoof
and it's going to give you stuff about it, like the different parameters that you can set.
So all we're going to set is DNS to spoof.
All and they said that the truth.
So this one to just say is going to apply to first of all, of course, they come through.
So that's what we want to do.
So we need to put sense, make sure you said before those.
So the next one we're going to do is set Dennis the spoof Dr Means.
And then let's say we want to do my website.
Anthony Timber's dot com.
Maybe that's the way we want to do, or maybe if they tried to go to Facebook dot com, you know, we
could separate them by commas.
So now you do that.
So now those are set.
All we have to do now is just turn it on.
So DNA is the spoof and then put on it enter and now it's on.
So now you can see right here the DNA spoof is on.
So any time they type in, Anthony Summers dot com is going to go is going to direct them right back
to our callisthenics machine and it's going to load the index, the e-mail file as long as Apache is
running.
And the same thing for Facebook dot com is going to load over to our colorist, which is going to load
up this file.
So let's go over to our Windows machine and actually see what happens when they try to do that.
So one day you might notice that you may or may not have to clear the browser cache.
And I'll see you, by the way, in a few minutes just for everything to replicate on the network and
for it to actually work.
So let's actually see what happens.
So right now, let's try to type in HTP.
We'll go through without any steps.
HGP Anthony Sevres Dotcom fun fact.
You don't have to figure it out recently, so let's do that.
So right now it is not working.
So let's give it like a minute or two and then we're going to come back and try it out.
OK, so actually like 10 seconds later I just tried it again and now it worked.
So a load of this page, it says, give me a password.
So let's say like I was if I was going to add that in service dot com and I knew that it was a login
page that looked like this.
So I would really just, you know, log in as usual.
If it looks like I thought it was a timber's and a super secret password, you can never guess.
So then what we're going to do is we're going to click log in.
And then we're going to see what happens.
So remember, like I told you on the back end, it is going to run the action on the page that file,
and this is what that page actually does.
So I made yesterday output this when you do it.
So says I now know your username is a timber's.
And are you serious?
The password is password.
One exclamation point.
Don't worry.
I've written into a file called President and the Virus Folder for safekeeping.
Thanks hashtag.
You've been hacked.
Imagine if you saw this when you're browsing on the web and we can actually confirm it.
I'm going to show you guys the file as well.
So let's go over to our colleagues and check that out.
OK, so let's actually change directory over to there just to make it easier for us to know.
So now if we do an less this directory, so you see that there's a text file.
So if you had a cat that might need to do Suto because this directory pseudo cat friends dot text and
Bam has a username in there and has the password that we saw in the browser.
So now we know that it actually works.
So using this thing in your mind, the different types of things you can do.
I'm going to show you also like kind of a practical example, and I'm going to give you a research file
for it as well.
A first is actually go look at this, because it's very helpful for you guys to understand a little
bit Sustiva and then check out the action page I can follow.
So just to walk you through this, just see see, I showed you what happened.
So let's the back end exactly how this is working.
So first of all, scripts typically start with this right here, the open bracket and then sideways,
what they want to call lessness, San Diego, questionmark.
And then it ends with a question mark and the grated inside.
So that's how PSP works.
So the first thing I did, I set a variable called login creds equal to a function called F Open, and
that's just going to create the file.
And I put a directory right here and then you separate about column.
I put W right here.
This means right.
This means right to the file.
Note that if you do this it will overwrite the file every single time and delete the contents of the
file was already there.
So if you do this multiple times you're going to see that the file is going to be deleted and then it's
going to recreate it.
Whatever you know is is written in this instance up and running.
So right here I just have a quick conditional.
If it can't create the file opening for whatever reason is just going to spit out an error.
This is unable to open a file in the browser.
So.
So as you saw before on the C I just saw before, it says all this stuff here, Nonno username Bubu
so we could do that with echo commands are very similar to Linux.
So just echo and make sure also with all IP and with a semicolon on each line of code.
So we just echo that we put a space and then when you're catching post parameters, which is so when
you make a login request, like with this form, it was making a post request and that's how it was
sending the e-mail to this file.
So the name of that post request was you name, so we can actually check it out.
So let's go it up.
So to do so is the search for such WTW, such a low price index, the Gmail password, so so as you
can see, like before I told you right here that the form, you know, sends everything to action page
up in the Methodist post.
So sending a post request and what is how it knows what parameters, what is right here where it says
name, you can send it to whatever you want.
I have it as you name for the username and then p e w for the password.
So let's go back over here.
So I echoed the value that was submitted under the name of you name and that was username.
And then, you know, I got another line and your super secret password I put this is also like a Tommo
that is outputting.
So I just use the line break right here.
The B-R with the two greater than less than signs around it as I start a new line in HTML and then also
echoed the password as W and then I this other stuff right here, just because that would be neat.
And to put it into the file, what I did was I say the username, so same exact thing, save the post
vye that was passed in as a verb will save the password when as a variable and then you use F right.
And then what you can do is put the default, the variable that we set earlier that actually, you know,
created the file.
So this is going to go into that file and write this right here and then have different lines just to
separate it out and make it look nice and everything.
So f right.
Same exact thing.
You put that variable right here that has the file in it and then we put the variable before.
I also could have just put the username one right there, but I went through and actually just put post
in there so you don't have to do this part is kind of optional.
Just I guess if you wanted to make a little cleaner a little bit easier, you get it that way.
That's why I cut that in there.
So as you can see, that's how the code works.
You can modify this and make it do a lot of different things on PSP isn't too complicated.
Is that the pretty's language?
But it is very powerful and is used extensively on the Internet.
So it's very helpful to understand how that works.
OK, so now we know how to launch attacks and breaking the computers.
So what's next?
So since we know how to actually get in there and compromise now we're now we're going to be going over
what you do after you successfully completed.
And inside is a wide variety of things that you can do.
You familiar with some of the stuff that you should probably be taking when you actually get into a
system because you might need to gain administrative access.
You might want to look for some files, a lot of different things.
So I appreciate you listening this far and I'll see you guys in the next section.