WEBVTT

00:00:02.029 --> 00:00:02.530
[Autogenerated] all right.

00:00:02.540 --> 00:00:03.810
Now the insulation is done,

00:00:03.910 --> 00:00:06.560
creating an access point in setting up a fake captive.

00:00:06.560 --> 00:00:07.870
Poor Oh is really easy.

00:00:08.610 --> 00:00:09.290
As I mentioned,

00:00:09.370 --> 00:00:13.640
wife find Pumping is a two capable within several worlds attacks in

00:00:13.640 --> 00:00:16.390
here We're focusing the fake captive Porter's attack,

00:00:16.570 --> 00:00:20.150
which, in my opinion, is one of the most effective ways of getting credentials.

00:00:21.310 --> 00:00:24.120
First, let's go to the setting stab on the left side.

00:00:24.120 --> 00:00:24.490
Minya.

00:00:26.140 --> 00:00:28.850
In year, we can configure the settings off the access point.

00:00:29.340 --> 00:00:30.000
For example,

00:00:30.040 --> 00:00:33.450
I'll change the name of my word is no trick to global Mantex Cooperate,

00:00:33.690 --> 00:00:34.560
which is similar.

00:00:34.560 --> 00:00:37.630
Offer victim WiFi name If you want,

00:00:37.800 --> 00:00:41.720
you can also change the channel in which of the natural you'll run next.

00:00:41.720 --> 00:00:44.150
We can also select the WiFi adapter that will use.

00:00:44.570 --> 00:00:47.460
In my case, I only have this Dublin zero doctor,

00:00:47.470 --> 00:00:51.270
which is supports monitor mode in the bottom of the screen.

00:00:51.360 --> 00:00:53.510
We can set up the security of this network,

00:00:53.840 --> 00:00:54.350
for example,

00:00:54.360 --> 00:00:58.350
who could enable W P two authentication and put a password for this network.

00:00:58.740 --> 00:00:59.970
But in my case,

00:01:00.050 --> 00:01:02.570
I will leave this without a dedication to increase the

00:01:02.570 --> 00:01:03.950
chances of someone connected to it.

00:01:05.239 --> 00:01:06.370
Cool despite is done.

00:01:06.600 --> 00:01:09.850
Now we have to enable the captive porter plugging for that.

00:01:10.010 --> 00:01:13.680
Let's go to the menu plug ins in there.

00:01:13.760 --> 00:01:15.850
You see that we have tons of programs available.

00:01:16.280 --> 00:01:19.580
For example, we could SSL is tripping or several other attacks.

00:01:20.140 --> 00:01:21.930
But again, in my case, I'm interesting.

00:01:21.930 --> 00:01:22.940
The captive Porter.

00:01:23.190 --> 00:01:24.650
So I was selected from the list.

00:01:26.500 --> 00:01:30.500
No, the less step is going to the captive portal section on the left side.

00:01:30.500 --> 00:01:35.250
Minya In here, we can select which same plate for captive porter we want.

00:01:36.040 --> 00:01:39.530
And this is basically set of HTML pages the simulated

00:01:39.530 --> 00:01:41.750
authentication screen off a captive porter.

00:01:42.340 --> 00:01:46.190
I could select any of item on this list, but in my case, I was selected.

00:01:46.190 --> 00:01:48.180
They're clogging, which is a dark theme.

00:01:48.180 --> 00:01:51.820
There's Indication Page, actually, Quick pose here.

00:01:51.920 --> 00:01:54.190
If you want to customize your authentication screen,

00:01:54.410 --> 00:01:57.690
it can easily do that by going to the folder where we have the wife I've

00:01:57.690 --> 00:02:02.340
permitting and then going to the folder plug ins in there.

00:02:02.480 --> 00:02:06.740
We can go to the folder captive Porter And then here

00:02:06.750 --> 00:02:08.350
we entering the templates forger.

00:02:09.090 --> 00:02:11.970
And here we have our the captive porter templates nettle.

00:02:12.840 --> 00:02:15.070
So then we enter in the folder of the template.

00:02:15.070 --> 00:02:15.850
Do you want to add it?

00:02:16.770 --> 00:02:18.490
And here we have two folders.

00:02:18.700 --> 00:02:22.650
One is called Static, which contains the CSS and JavaScript of the page,

00:02:23.300 --> 00:02:26.920
and the other one is called Template, which contains the dedication page,

00:02:26.990 --> 00:02:29.250
which is this Logan dot html.

00:02:30.040 --> 00:02:30.440
In here,

00:02:30.540 --> 00:02:34.250
he added this HMO file to make it look like the company you're attacking,

00:02:34.900 --> 00:02:36.770
for example, in kidding, said their logo,

00:02:36.780 --> 00:02:39.170
or even change the text to some more convincing.

00:02:40.510 --> 00:02:41.050
Perfect.

00:02:41.060 --> 00:02:42.170
Now let's go back to the wife.

00:02:42.170 --> 00:02:44.580
I'm bunking here.

00:02:44.620 --> 00:02:45.560
We already configured.

00:02:45.560 --> 00:02:49.030
The settings were enabled a captive porter plugging and you already

00:02:49.030 --> 00:02:51.430
selected a template they're gonna be using for authentication.

00:02:51.430 --> 00:02:54.950
Page I will have to do is clicking the start button.

00:02:57.140 --> 00:02:57.630
Perfect.

00:02:57.760 --> 00:03:01.020
Now WiFi pumpkin is launching tones of stairs in the background,

00:03:01.390 --> 00:03:03.190
and you can see this in this Progress bar.

00:03:05.100 --> 00:03:05.520
Awesome.

00:03:05.720 --> 00:03:10.090
No, or access points is ready to be used as you can see my phone.

00:03:10.210 --> 00:03:12.580
I have not global Mantex corporate WiFi.

00:03:13.490 --> 00:03:16.400
Once I connect to it, it asked me, still looking into this network.

00:03:17.190 --> 00:03:19.100
If we go to the monitor activity tab,

00:03:19.210 --> 00:03:23.670
you see request year and here there's some get requests from my phone.

00:03:25.140 --> 00:03:28.950
Once the dedication page is loaded on my phone, we type the credentials.

00:03:29.940 --> 00:03:33.760
Once I submit the credentials you say post request here and

00:03:33.760 --> 00:03:35.610
is showing that the user posted some data.

00:03:36.210 --> 00:03:38.750
Now we can go to the credential monitor tab,

00:03:39.550 --> 00:03:42.650
and you see that credentials that I typed on my phone are right here.

00:03:43.200 --> 00:03:46.950
You note that he used a percentage 40 instead of the at symbol,

00:03:47.400 --> 00:03:49.500
and that's because it isn't asking courted.

00:03:49.940 --> 00:03:52.090
So instead of showing special characters,

00:03:52.260 --> 00:03:55.370
you show the asking cold, and that's it.

00:03:55.610 --> 00:03:57.660
If another users have meets another credential,

00:03:57.670 --> 00:04:00.100
Your show here in this ring pretty easy,

00:04:00.100 --> 00:04:00.460
right?

00:04:00.730 --> 00:04:03.510
In just few minutes, we set up a fake captive poor Oh,

00:04:03.520 --> 00:04:07.580
that is able to harvest to use their credentials after it done.

00:04:07.680 --> 00:04:09.220
If you want to stop the access point,

00:04:09.250 --> 00:04:11.550
all we have to do is click on the stop button