And the previous lecture we learned how to use better cap to run an AARP spoofing attack and place ourselves
in the middle of the connection between a computer and the access point.
And every time I do this I keep saying this means that all the requests and all the responses will flow
through our computer.
Which means that we'll be able to see anything a user does on the Internet.
So we should be able to see the or else the images the videos the passwords they log in with or anything
they sent or receive.
So right now we are already in the middle of the connection and this data is already flowing through
our computer.
So all we have to do is just use a program to capture this data and analyze it.
Now we can use wire shark to do that and I will cover this later on in the course.
But for now I'm going to use a really nice module that comes with better cap that will automatically
capture all of this data analyze it and show me the interesting stuff.
So all we have to do now is to tell better cap to capture all of the data that is flowing through this
computer and analyze it for me and to do this we can use the net dot sniff module so you can do help
followed by net dot sniff to see all of the options that you can set for this module.
What I showed you how to read options and change them.
So for now I actually want to run it without modifying any of the options so I'm just going to do net
dot sniff on so now everything that's going to flow through this computer will be captured and analyzed
by the net dog sniff module so I'm going to close this terminal window and let's go to the target Windows
computer.
I'm going to open my web browser and we're going to generate some traffic and see if that's going to
be captured by better cup.
What we're doing right now will not work against hasty G.P.S..
But don't worry we'll talk about how to bypass hasty TPA later on and why this won't work.
But for now for testing I'm just going to go to a Web site called Bold web and I'm going to include
its link in the resources of this lecture.
So as you can see this is a normal Web site that doesn't use ETP as it also has a number of links here
so if I click for example on this link everything is loading fine.
As you can see here but if we go to the Kelly machine you'll see that every request that we sent was
actually captured by this computer.
So you can do this to any computer that is connected to the same network as you whether it's a wired
or wireless network so you can see there were requests sent to Google.
If you scroll down you'll see we made the request for this Web site.
One Web dot com.
You can also see all of the other files that this Web site loaded so you can see we have a logo loaded
here.
You can see we have our Stiles file being loaded here.
Again if there were more images you'll actually see links to all of the images that are being loaded.
You can see here we are.
This is the second link that we clicked on the test BHP that one web dot com.
So this is what we have right here here in the top.
Now also let me just go back and maybe click on the first one.
And as you can see this is another Web site.
It has a log in functionality in here and that's try for example log in with a user name.
Let's set the user name to my name Zaid Sabi and that's put the password as 1 2 3 4 5 6 7 8 9 0.
I'm gonna click on log in again as you can see we got logged in no issues at all but if I go back to
the Caylee computer and scroll up as you can see we captured a log in that was sent to this Web site
test hasty AML 5 that volume web dot com.
Again this is exactly the Web site that we have here.
And if you look in here you can see that the user name was a SRB and the password was 1 2 3 all the
way up to 9 0.
So basically the idea that I'm trying to get across right now anything that the target computer sends
or receives right now will be captured by the Kelly machine.
And like I said we can do this to any computer or any phone that is connected to this same network as
us whether it's a Wi-Fi or a wired network.