WEBVTT 00:00:02.320 --> 00:00:05.480 In this demo, we are going to run network reconnaissance with Cain. 00:00:06.020 --> 00:00:08.460 This includes actively monitoring wireless networks 00:00:08.470 --> 00:00:10.660 and cracking WPA preshared keys, 00:00:10.930 --> 00:00:13.520 as well as sniffing our victim network to identify 00:00:13.520 --> 00:00:15.550 systems that we can target in our attack. 00:00:16.020 --> 00:00:18.350 We are going to start off on our Windows attack system. 00:00:19.040 --> 00:00:23.000 I have the system antivirus disabled to ensure I can successfully install Cain, 00:00:23.000 --> 00:00:27.410 and I have a USB wireless card connected to my virtual machine to 00:00:27.410 --> 00:00:29.800 allow me to review wireless networks nearby. 00:00:30.330 --> 00:00:32.110 Let's start off by installing Cain. 00:00:32.800 --> 00:00:34.080 The setup is very simple. 00:00:34.350 --> 00:00:37.270 I will double‑click on the executable for Cain and Abel and 00:00:37.270 --> 00:00:39.050 click Next through the default setup. 00:00:39.630 --> 00:00:43.050 Ensure you also install WinPcap as well, 00:00:43.060 --> 00:00:45.330 when prompted during the installation process, 00:00:45.400 --> 00:00:47.950 to take advantage of the network capabilities of Cain. 00:00:48.440 --> 00:00:51.990 Now that the install is complete, let's get started using Cain. 00:00:52.430 --> 00:00:53.930 We will start by opening Cain. 00:00:54.340 --> 00:00:58.980 For this demo we'll be using the Wireless, Cracker, and Sniffer tabs. 00:01:00.230 --> 00:01:02.400 We will begin on the Wireless tab. 00:01:02.400 --> 00:01:07.510 Here we can use our wireless card and the WinPcap driver to review 00:01:07.510 --> 00:01:10.840 some basic information on nearby wireless networks. 00:01:11.730 --> 00:01:14.400 Start by navigating to the config menu. 00:01:14.400 --> 00:01:18.950 On the Sniffer tab, it will show the available network cards to use by Cain. 00:01:19.440 --> 00:01:22.600 Scrolling to the right to the Description column will help 00:01:22.600 --> 00:01:24.790 better identify the different network cards. 00:01:25.600 --> 00:01:28.910 Now we will close the config menu and select our wireless card 00:01:28.910 --> 00:01:31.350 from the drop‑down menu on the Wireless tab. 00:01:31.940 --> 00:01:37.170 We now click Active Scan, and Cain will begin scanning for wireless networks. 00:01:37.830 --> 00:01:41.690 From the scan, we can easily see the types of wireless networks available to us, 00:01:41.870 --> 00:01:44.840 including the network name, whether it is encrypted, 00:01:45.240 --> 00:01:48.080 the BSSID, and the channel it's on. 00:01:48.080 --> 00:01:51.620 The remaining features of the Wireless tab focus on passive scans, 00:01:51.690 --> 00:01:54.100 which allow for gathering of network traffic. 00:01:54.400 --> 00:01:54.770 However, 00:01:54.770 --> 00:01:57.750 these features will require the use of an AirPcap card 00:01:58.140 --> 00:01:59.650 connected to the Windows system. 00:02:00.590 --> 00:02:02.620 However, if you have a wireless capture, 00:02:02.920 --> 00:02:06.850 Cain can still identify and crack preshared keys using a dictionary attack. 00:02:07.640 --> 00:02:08.350 For this demo, 00:02:08.350 --> 00:02:11.580 we will download a WPA capture sample from the Wireshark 00:02:11.580 --> 00:02:13.770 website to perform our attack against. 00:02:14.740 --> 00:02:15.850 Once we have our sample, 00:02:15.850 --> 00:02:20.990 we will move to the Cracker tab in Cain and click on the 802.11 Captures filter. 00:02:21.910 --> 00:02:25.630 We now click on the blue plus icon in the top ribbon and 00:02:25.630 --> 00:02:27.850 select the capture file and click Open. 00:02:28.730 --> 00:02:31.610 The file directory will now appear as a capture file, 00:02:31.620 --> 00:02:34.240 which we'll right‑click on and select Analyze. 00:02:34.240 --> 00:02:39.090 Here Cain will identify any potential WPA handshakes that can be cracked. 00:02:39.640 --> 00:02:43.190 We see our capture file does indeed have a handshake available to crack. 00:02:43.840 --> 00:02:49.250 We will click on it and select Send WPA Hashes to Cracker, and close the window. 00:02:50.240 --> 00:02:53.720 Click on the WPA‑PSK Auth filter option, 00:02:54.060 --> 00:02:56.500 and we see the handshake information has been found. 00:02:57.340 --> 00:03:01.200 Selecting and right‑clicking will give us two options to crack the PSK, 00:03:02.030 --> 00:03:03.980 either performing a dictionary attack against the 00:03:03.980 --> 00:03:06.250 handshake or a brute‑force attack. 00:03:07.240 --> 00:03:07.990 For this demo, 00:03:07.990 --> 00:03:10.790 we will select a dictionary attack to run against the handshake. 00:03:10.790 --> 00:03:14.020 In the Dictionary Attack window, we will have the option to 00:03:14.020 --> 00:03:16.700 select our dictionary file in the Dictionary section by 00:03:16.700 --> 00:03:18.950 right‑clicking and select Add to list. 00:03:19.540 --> 00:03:22.810 We select our dictionary text file and click Open. 00:03:22.810 --> 00:03:25.170 With the dictionary now loaded, 00:03:25.220 --> 00:03:28.570 we can start our attack. Cain offers the ability to not only 00:03:28.570 --> 00:03:31.010 submit the words listed in our dictionary file, 00:03:31.080 --> 00:03:32.780 but use derivatives of the words, 00:03:32.890 --> 00:03:35.950 such as changing the case or order of the words in our list. 00:03:36.640 --> 00:03:39.830 To reduce the time it will take us to run through our dictionary, I will 00:03:39.840 --> 00:03:43.520 uncheck the various options so that we are only submitting the words as 00:03:43.520 --> 00:03:45.400 they are contained in the dictionary file. 00:03:46.140 --> 00:03:47.830 However, during an actual attack, 00:03:47.840 --> 00:03:50.700 I would recommend taking advantage of these options available in Cain, 00:03:51.050 --> 00:03:53.590 depending on the size of your dictionary list and the 00:03:53.590 --> 00:03:55.150 time you have to run your attack. 00:03:55.740 --> 00:03:58.570 We're now ready to start our attack and click Start. 00:03:59.240 --> 00:04:02.260 Cain will now cycle through the words contained in our file to find a 00:04:02.260 --> 00:04:05.550 match against the WPA handshake the program has analyzed. 00:04:06.140 --> 00:04:08.330 And after submitting a number of failed passwords, 00:04:08.330 --> 00:04:12.430 we have identified the key. Back on the Cracker tab, the password is 00:04:12.430 --> 00:04:14.600 now listed along with the handshake information. 00:04:15.220 --> 00:04:17.170 Once we're on a network we want to target, 00:04:17.420 --> 00:04:20.250 we can use Cain to click on the Sniffer tab to perform some 00:04:20.250 --> 00:04:23.140 reconnaissance to identify systems to target with Cain and 00:04:23.140 --> 00:04:24.850 Abel to access credentials. 00:04:25.640 --> 00:04:30.520 We will again click on the config menu and the Sniffer tab so we can select 00:04:30.530 --> 00:04:33.300 our network card to use for our network sniffing activities. 00:04:34.140 --> 00:04:35.030 For this demo, 00:04:35.040 --> 00:04:38.600 we will assume that we're connected to the Globomantics local area network, 00:04:39.000 --> 00:04:42.150 so we will select our internal network card for our sniffing attack. 00:04:42.920 --> 00:04:43.470 Additionally, 00:04:43.470 --> 00:04:46.270 we can configure the sniffing feature of Cain to start 00:04:46.280 --> 00:04:49.230 automatically upon running Cain on our system. 00:04:49.490 --> 00:04:50.120 By default, 00:04:50.120 --> 00:04:53.720 the sniffer will run in promiscuous mode, which will mask our network card's 00:04:53.720 --> 00:04:58.220 MAC address. This feature will also allow us to run added tests against systems 00:04:58.230 --> 00:05:00.850 on the victim network to help our reconnaissance. 00:05:01.550 --> 00:05:02.860 With our network card selected, 00:05:02.870 --> 00:05:06.700 we will click OK and start scanning for systems on the network. 00:05:07.840 --> 00:05:10.280 We will start the sniffer by clicking on the red‑and‑green 00:05:10.290 --> 00:05:14.290 icon in the ribbon menu and then click on the blue plus 00:05:14.290 --> 00:05:16.250 icon, also in the same menu. 00:05:17.420 --> 00:05:20.350 We will choose to scan all hosts on the subnet; however, 00:05:20.350 --> 00:05:23.690 you can also choose a specific range of IP addresses to target. 00:05:24.140 --> 00:05:27.850 We're also going to select all promiscuous mode tests and click OK. 00:05:29.580 --> 00:05:32.130 The Cain sniffer will now perform all of its tests to 00:05:32.130 --> 00:05:33.850 identify systems on the network. 00:05:34.450 --> 00:05:37.090 Different types of systems will respond to some of the tests, 00:05:37.260 --> 00:05:42.050 but not others, so using all of the tests at our disposal will help to ensure we 00:05:42.050 --> 00:05:44.850 have the fullest picture of the victim network as possible. 00:05:45.540 --> 00:05:49.730 Cain will populate IP and MAC addresses and place stars in the column 00:05:49.860 --> 00:05:54.090 for each test that a response is received for. Now select the first 00:05:54.100 --> 00:05:57.570 entry and the last entry while holding the Shift key and right‑click 00:05:57.570 --> 00:06:01.540 and select Resolve Host Name to populate additional information about 00:06:01.540 --> 00:06:02.860 the systems on the network. 00:06:03.640 --> 00:06:06.440 We now have a full list of systems we can target with Cain 00:06:06.440 --> 00:06:08.650 and Abel on the Globomantics network. 00:06:09.240 --> 00:06:12.210 This will end our demo, where we learned how to run reconnaissance 00:06:12.210 --> 00:06:16.100 on a network using Cain, as well as how to analyze and crack WPA 00:06:16.100 --> 00:06:18.390 handshakes using a dictionary attack.