WEBVTT 00:00:01.740 --> 00:00:02.290 [Autogenerated] Hey there. 00:00:02.330 --> 00:00:03.090 I'm Rick Iroh. 00:00:03.100 --> 00:00:06.070 I'm a separate security specialist and I'll be showing you how to harvest 00:00:06.070 --> 00:00:09.170 credential using fake captive Porter's created by the wife. 00:00:09.170 --> 00:00:10.150 Five pumpkin, too. 00:00:11.480 --> 00:00:14.920 So invention that your newly promoted manager at Global Man Tick 00:00:15.280 --> 00:00:17.540 You're in a tight deadline to deliver a report today. 00:00:17.800 --> 00:00:18.680 But for some reason, 00:00:18.760 --> 00:00:22.200 your WiFi right now is not the best it could get into connected and you 00:00:22.200 --> 00:00:24.450 start to get a piece off because his delay in your work. 00:00:25.120 --> 00:00:28.350 So you take a look to see if there's any other wife and attacks around you. 00:00:28.740 --> 00:00:33.870 Then you find his global Mantex corporate network as your wife is really bad. 00:00:33.930 --> 00:00:34.890 You connected this one. 00:00:35.510 --> 00:00:38.940 The first thing you see is a page with the global Mantex logo asked him 00:00:38.940 --> 00:00:41.050 to look again so you can access the internal network. 00:00:41.640 --> 00:00:45.520 You take your credentials and you look into the net trick perfect rate. 00:00:45.690 --> 00:00:48.210 Everything works and in turn so fast that even tell your 00:00:48.210 --> 00:00:50.400 colleagues to connected a new global Matics WiFi. 00:00:51.140 --> 00:00:53.590 The only problem is his wife friend metric was 00:00:53.600 --> 00:00:55.220 actually created by a malicious person. 00:00:55.640 --> 00:01:00.010 And this captive porter is a fake up to porter creating used the WiFi pumping, 00:01:00.440 --> 00:01:02.410 and this means they're your credentials are now in 00:01:02.410 --> 00:01:03.790 the hands of a malicious person. 00:01:04.290 --> 00:01:06.450 And just like that, you have a recount compromised. 00:01:07.940 --> 00:01:12.010 The wife I've pumpkin Framework is one of my favorite tools in a neighbor's too 00:01:12.020 --> 00:01:14.950 easily perform several worlds attacks in just feel clicks. 00:01:16.140 --> 00:01:20.050 This, too, was developed by Michael's bone Thin and his team at the PLC labs. 00:01:20.640 --> 00:01:23.750 And thanks to them, my life as a red team specialises ways. 00:01:23.750 --> 00:01:27.530 Er, they did an amazing job at putting out the main wife for attacks. 00:01:27.530 --> 00:01:30.050 No one single, too, that is reliable and easy to use. 00:01:30.540 --> 00:01:31.460 So thanks, Michael. 00:01:32.320 --> 00:01:33.770 And if you like the two s, I do, 00:01:33.910 --> 00:01:36.850 don't forget to go to their get hub and even leave a donation for them. 00:01:37.640 --> 00:01:40.540 The wife of pranking is a rogue access point framework too 00:01:40.550 --> 00:01:42.350 easily create fake wife right networks. 00:01:43.040 --> 00:01:44.420 The interesting part of this, too, 00:01:44.590 --> 00:01:47.650 is that includes several mortars such as transferring proxy 00:01:47.660 --> 00:01:50.550 are poisoning fishing manager and much more. 00:01:51.540 --> 00:01:54.750 The module be discussing today is the captive port of Marshall, 00:01:54.890 --> 00:01:56.520 which is a red included by default. 00:01:56.530 --> 00:01:57.300 In the latest wife. 00:01:57.300 --> 00:01:58.350 I bump key versions. 00:02:00.240 --> 00:02:01.650 They're really cool thing about this, too. 00:02:01.770 --> 00:02:03.060 Is that an open source? 00:02:03.070 --> 00:02:04.440 And they get new version three, 00:02:04.660 --> 00:02:08.350 which means that it can Donald the source code and customize it as most is one. 00:02:09.240 --> 00:02:11.450 We'll download this tooth from their official get help, 00:02:11.570 --> 00:02:13.970 which also contains tones of the commendations and to 00:02:13.970 --> 00:02:15.350 tour of teaching how to use the tool. 00:02:16.340 --> 00:02:17.470 As you seen this course. 00:02:17.490 --> 00:02:19.570 It is really easy to install and use the two, 00:02:19.850 --> 00:02:22.020 and it comes with several attacks out of the box, 00:02:22.440 --> 00:02:23.920 such as pecking injection, 00:02:24.010 --> 00:02:27.930 HDP credential monitoring are poisoning Dennis spoofing and, 00:02:27.930 --> 00:02:29.850 of course, fake captive porters. 00:02:30.860 --> 00:02:33.760 Those tools are a prince told me that in less than five 00:02:33.760 --> 00:02:36.490 minutes you can set up an attack, which is very handy. 00:02:36.500 --> 00:02:38.170 We're in the middle of a red team exercise. 00:02:39.940 --> 00:02:41.860 If you're familiar, The Red Team Q Ching. 00:02:42.030 --> 00:02:42.540 This, too, 00:02:42.590 --> 00:02:45.870 can be used during the recall and exploitation faces in which we're 00:02:45.870 --> 00:02:49.020 trying to figure out a way to get into the company and using valid 00:02:49.020 --> 00:02:51.050 credentials is a release a way of doing that. 00:02:52.900 --> 00:02:55.200 So if in mapping techniques that we learned this 00:02:55.200 --> 00:02:57.210 course to the minor attack framework, 00:02:57.290 --> 00:03:02.730 we see that we're focusing one main area which is initial access inside 00:03:02.730 --> 00:03:05.250 of the initial access week over two main techniques. 00:03:05.780 --> 00:03:10.400 The 1st 1 is a T 14 65 which is a creation off road access 00:03:10.400 --> 00:03:12.970 points and with a rogue access point, 00:03:13.090 --> 00:03:16.760 we will create a fake captive portal to harvest vile accounts, 00:03:16.970 --> 00:03:20.590 which is a technique t 10 78 on the minor attack framework. 00:03:21.540 --> 00:03:24.550 As you see, we combined it to techniques into one attack. 00:03:26.240 --> 00:03:29.220 In my opinion, the best way of learning something is by singing it. 00:03:29.490 --> 00:03:31.650 So let me show you How does attack works? 00:03:32.380 --> 00:03:34.450 Let's say you were trying to attack global Mantex. 00:03:34.900 --> 00:03:36.220 They have their internal data center, 00:03:36.460 --> 00:03:39.510 the internals switches and one wife friend network in which most of 00:03:39.510 --> 00:03:42.820 the employees connect to while in your re com Phaze. 00:03:42.950 --> 00:03:45.550 You saw that these WiFi network is called global Mantex. 00:03:45.550 --> 00:03:46.150 Cooperate. 00:03:47.230 --> 00:03:48.360 So what do we do? 00:03:48.420 --> 00:03:51.130 Is creating a wife like access point with the singing or 00:03:51.130 --> 00:03:53.250 similar name to the regional WiFi network. 00:03:53.840 --> 00:03:56.270 For example, we can use global Mantex dash, 00:03:56.270 --> 00:03:59.850 cooperate or even something like Global man tick secure WiFi. 00:04:00.680 --> 00:04:03.450 Once we have the access point day, we have two options. 00:04:03.780 --> 00:04:08.050 We can simply wait for people to connect to a network or if the client agrees, 00:04:08.100 --> 00:04:10.210 we can cause instability in the original wife, 00:04:10.210 --> 00:04:10.730 a network. 00:04:10.910 --> 00:04:12.550 So then people look for a new network. 00:04:13.440 --> 00:04:14.000 In any case, 00:04:14.060 --> 00:04:16.700 people start to disconnect from the current network and start 00:04:16.700 --> 00:04:18.750 to connect to a fake a WiFi access point. 00:04:19.670 --> 00:04:20.790 As soon as they connect, 00:04:20.980 --> 00:04:24.460 they'll be prompted with a looking page that looks like from global Mantex. 00:04:25.070 --> 00:04:28.250 And this looks like a captive porter in the hotel or in the airport, 00:04:28.600 --> 00:04:30.220 which means it don't look into the poor. 00:04:30.220 --> 00:04:31.950 Oh, you don't have accident at TriC. 00:04:32.740 --> 00:04:34.050 So then thing, please. 00:04:34.060 --> 00:04:37.400 Well timed their credentials into this form and when they submitted, 00:04:37.440 --> 00:04:39.350 will be able to capture the credentials. 00:04:40.040 --> 00:04:40.850 Pretty cool, right? 00:04:41.030 --> 00:04:44.260 We can easily get some valid accounts also, 00:04:44.300 --> 00:04:47.340 if you have your computer connect to the Internet after its indication, 00:04:47.500 --> 00:04:50.650 the wife of pumping would then allow the person to access the Web. 00:04:51.240 --> 00:04:54.610 Basically, the two bridges, the rogue WiFi access points, 00:04:54.720 --> 00:04:57.250 tow whatever you have connected in your order network interface. 00:04:57.710 --> 00:05:00.760 So if you have access to an Ethernet port in the client, 00:05:00.900 --> 00:05:03.570 let's say on the meeting room the people that connect to 00:05:03.570 --> 00:05:06.550 your access point who have access to the Internet trick and 00:05:06.550 --> 00:05:07.950 will not suspect about anything. 00:05:08.740 --> 00:05:11.680 Also, even though it may take some time for people to connect her, 00:05:11.680 --> 00:05:16.150 your wife I Once they do, you have clear tax passer for someone in the company, 00:05:16.810 --> 00:05:19.230 meaning that will be able to look in the A VPN or use 00:05:19.230 --> 00:05:20.850 the credentials to access the email. 00:05:21.690 --> 00:05:22.190 Personally, 00:05:22.290 --> 00:05:25.540 I like to set up a fake access point writing the beginning of the engagement. 00:05:25.890 --> 00:05:29.090 So then I can go to some other writing tests and come back 00:05:29.090 --> 00:05:30.850 later to check if I got any credentials. 00:05:31.840 --> 00:05:33.460 One thing that'll save me a lot of time. 00:05:33.630 --> 00:05:37.750 It's having the WiFi pumping set upon a raspberry pi or in a spare laptop. 00:05:38.200 --> 00:05:41.930 So then I can just hide it somewhere and leave it harvesting credentials. 00:05:42.250 --> 00:05:43.530 Then, in the end of the date, 00:05:43.610 --> 00:05:46.450 I can go back and check if I got any user names and passwords. 00:05:48.240 --> 00:05:50.530 But before getting to the technical part of this course, 00:05:50.590 --> 00:05:53.570 I want you to keep in mind that performing this attack without 00:05:53.570 --> 00:05:55.650 authorization isn't leaving most of the countries, 00:05:56.190 --> 00:05:59.330 and this means if you create a fake WiFi in the airport or a 00:05:59.330 --> 00:06:01.740 library with intent of stealing credentials. 00:06:01.750 --> 00:06:03.930 You may go to jail, and that's not cool. 00:06:04.270 --> 00:06:07.560 So it is important to stay legal first. 00:06:07.610 --> 00:06:09.220 If you're working on writing project, 00:06:09.410 --> 00:06:11.380 make sure you have a letter for engagement From Declined 00:06:11.630 --> 00:06:13.590 detailing the dates of the test to be executed, 00:06:13.760 --> 00:06:17.990 as was the types off attacks _____ scope also is important to 00:06:17.990 --> 00:06:21.040 have a formal document signed by the client detailing in 00:06:21.040 --> 00:06:22.850 authorizing the taxi will be performing. 00:06:23.590 --> 00:06:26.840 And this is the document differentiates a criminal from professional 00:06:26.840 --> 00:06:30.450 retina specialist and has a personal recommendation. 00:06:30.560 --> 00:06:33.630 Always consulted the clients before executing any attack 00:06:33.640 --> 00:06:35.150 that may cause impacting the network. 00:06:35.680 --> 00:06:36.790 So but online. 00:06:37.110 --> 00:06:41.080 Don't be a criminal to follow the demos. 00:06:41.080 --> 00:06:42.850 In its course, you need two things. 00:06:43.610 --> 00:06:47.150 The 1st 1 is a laptop or a virtual machine with calla ranks. 00:06:47.840 --> 00:06:48.390 In theory, 00:06:48.540 --> 00:06:51.020 it can use the Annie Lennox abortion you want as long as 00:06:51.020 --> 00:06:52.350 you saw under The penance is on it. 00:06:52.940 --> 00:06:53.500 However, 00:06:53.590 --> 00:06:55.920 I do like to use color remarks because most of the 00:06:55.920 --> 00:06:58.190 dependence is already sold here. 00:06:58.200 --> 00:07:01.450 I'm using the cattle Lennox's version 2019.4. 00:07:01.930 --> 00:07:05.080 I do recommend using the specific version because it has all 00:07:05.080 --> 00:07:06.650 the libraries that we need for this demo. 00:07:07.220 --> 00:07:10.030 But if you want to use the newer kind of Linux versions, 00:07:10.130 --> 00:07:13.250 you may need to Mannering startup Iten Q T for library. 00:07:14.690 --> 00:07:18.750 The second requirement is a WiFi network card that supports monitor mode. 00:07:19.640 --> 00:07:21.120 If you're not familiar monitor mode, 00:07:21.290 --> 00:07:24.060 it basically means that the network card should be able to sniff 00:07:24.060 --> 00:07:26.550 wireless traffic and inject packets into the world. 00:07:26.550 --> 00:07:28.210 Is that just go? 00:07:28.210 --> 00:07:29.990 Go network card monitor mode, 00:07:30.020 --> 00:07:33.020 and you find out about the network cards that supports monitor mode. 00:07:33.640 --> 00:07:39.850 My two favorite network cards are the TP Link 7 to 2 n and the Alfa 0 36 in H. 00:07:40.540 --> 00:07:44.150 Both of them are supported by color and eggs and the WiFi pumpkin, too. 00:07:44.990 --> 00:07:48.950 In this demo amusing tippling, which appeal isn't $15 on Amazon. 00:07:49.840 --> 00:07:50.920 So if you're ready, 00:07:51.050 --> 00:07:53.850 let's go to color next and see how to harvest some credentials.