WEBVTT

00:00:01.640 --> 00:00:03.670
[Autogenerated] if you found the previous demo interesting.

00:00:03.750 --> 00:00:05.960
I want to show you some other ways of getting even

00:00:05.960 --> 00:00:07.600
more credentials using the wife.

00:00:07.600 --> 00:00:08.250
I'm punking.

00:00:09.140 --> 00:00:12.650
Let's hear now Red Team engagement and you got access to our internal network.

00:00:13.190 --> 00:00:15.090
So then, as it explained before,

00:00:15.100 --> 00:00:17.930
when you create a fake access point wife are bumpy,

00:00:17.940 --> 00:00:20.530
we will redirect out the traffic from the WiFi users

00:00:20.690 --> 00:00:24.450
to the Ethernet port or for laptop, which is connected internal network.

00:00:25.240 --> 00:00:28.250
And this means that for all the WiFi users on your network,

00:00:28.310 --> 00:00:30.600
when they try to access service on the Internet,

00:00:30.780 --> 00:00:32.750
all the traffic will go through your machine,

00:00:33.140 --> 00:00:36.250
and this allows us to easily eavesdrop all the traffic.

00:00:37.590 --> 00:00:43.220
Now let's go back to color Lennox, so I can show you how this works in here.

00:00:43.230 --> 00:00:43.650
Already.

00:00:43.650 --> 00:00:45.970
Have one person connected my fake access point,

00:00:46.340 --> 00:00:48.750
and you can see that in the bottom right of the screen.

00:00:49.020 --> 00:00:51.350
Or you can go through option the station monitor.

00:00:52.440 --> 00:00:55.450
In here, you can see the Mac address off the person connecting my WiFi,

00:00:56.140 --> 00:00:58.020
and because this person is connected to my wife,

00:00:58.020 --> 00:00:59.340
I off the traffic off.

00:00:59.340 --> 00:01:02.640
This person is going through my laptop and this makes

00:01:02.640 --> 00:01:04.150
it easy to eavesdrop the traffic.

00:01:05.140 --> 00:01:06.850
So let's open a warrior Scherick.

00:01:07.710 --> 00:01:09.230
If you're not familiar, Where shark?

00:01:09.290 --> 00:01:10.140
A direct command.

00:01:10.140 --> 00:01:10.850
You studying it?

00:01:11.290 --> 00:01:13.630
It is a tool that allows you to see every single

00:01:13.630 --> 00:01:15.650
packet in all your network interfaces.

00:01:16.640 --> 00:01:20.840
As you can see here, I have to maintain faces the E th zero,

00:01:20.850 --> 00:01:23.350
which is the Ethernet port connected internal network,

00:01:23.990 --> 00:01:26.620
and a Dublin port, which is my WiFi card,

00:01:26.660 --> 00:01:30.620
in which people are connected to just get traffic for one of those ports.

00:01:30.700 --> 00:01:32.150
I just have to double click on it.

00:01:32.840 --> 00:01:33.530
In my case.

00:01:33.620 --> 00:01:35.250
Oh, double click on the W Land.

00:01:35.530 --> 00:01:37.870
Since I want to see out the traffic that is coming from my wife,

00:01:37.870 --> 00:01:41.010
I users awesome.

00:01:41.020 --> 00:01:41.540
Think a look.

00:01:41.650 --> 00:01:43.850
We can see how to track for this WiFi network.

00:01:44.490 --> 00:01:44.970
In here,

00:01:44.990 --> 00:01:47.190
you see tons of encrypted packets as well was

00:01:47.200 --> 00:01:48.650
ordered not so interesting packets,

00:01:49.140 --> 00:01:51.350
but let's see if we can find something interesting here.

00:01:51.930 --> 00:01:56.310
One thing we can do is to search for insecure protocols such as http

00:01:56.660 --> 00:02:01.820
FTP and telling it those first calls are transmitted in plain text

00:02:02.050 --> 00:02:05.620
mean that we can easily eavesdrop on them two fugitives packets to

00:02:05.620 --> 00:02:07.020
see only a chubby traffic.

00:02:07.040 --> 00:02:12.830
Our jobs go to the future bar type HDP and presenter Perfect.

00:02:12.860 --> 00:02:17.150
As you can see, where shark futures tow us to see only the HP packets,

00:02:17.970 --> 00:02:20.110
those packets are turning an encrypted,

00:02:20.320 --> 00:02:21.950
meaning that we can see what's being transmitted.

00:02:22.980 --> 00:02:24.510
One interesting thing to take a look.

00:02:24.520 --> 00:02:25.850
Our posts requests.

00:02:26.330 --> 00:02:28.830
And that's because looking pages usually used this type

00:02:28.830 --> 00:02:30.580
of requests to do authentication.

00:02:31.640 --> 00:02:33.860
So let's investigate this post request.

00:02:33.860 --> 00:02:36.890
Here we can see tons of for information about this packet,

00:02:37.160 --> 00:02:40.850
such a source destination and even the browser that person was using.

00:02:41.740 --> 00:02:43.970
But interesting part here is this less one.

00:02:44.110 --> 00:02:46.250
The HDP form details.

00:02:47.180 --> 00:02:48.080
If you expand it,

00:02:48.130 --> 00:02:51.550
we can see that this page send two variables of you the post method,

00:02:52.040 --> 00:02:56.850
one for username and one for a password and take a look during plain text.

00:02:57.520 --> 00:02:58.250
Pretty cool, right?

00:02:58.780 --> 00:03:03.660
And that's why every recommends using https instead of htp and believe or not,

00:03:03.670 --> 00:03:08.560
Ah, lot of legacy systems such as Internet systems is to use an HP instead of H.

00:03:08.560 --> 00:03:10.520
P s, which is good for us.

00:03:10.680 --> 00:03:12.350
It becomes a real easy to get credentials