Speaker A
Hi, and welcome back to another episode on how to hack. So today, we are going to discuss using AutoCAP to perform Address Resolution Protocol poisoning.
Learn how to perform ARP poisoning and man-in-the-middle attacks using Ettercap on Kali Linux to capture usernames, passwords, and session data.
Key Takeaways
- Ettercap is a powerful tool for performing ARP poisoning and man-in-the-middle attacks on local networks.
- Proper network interface selection and IP forwarding configuration are essential for successful ARP spoofing.
- Captured traffic can reveal sensitive information such as usernames, passwords, and session cookies.
- Using virtual machines allows safe practice and demonstration of cybersecurity attack techniques.
- Understanding ARP poisoning helps in both offensive security testing and defensive network protection.
Summary
- Introduction to ARP poisoning and man-in-the-middle attacks using Ettercap (AutoCAP) on Kali Linux.
- Explanation of how ARP poisoning works by broadcasting fake MAC and IP addresses to poison ARP caches.
- Setup demonstration using VirtualBox with Kali Linux, Windows 10 victim machine, and Metasploitable server.
- Using commands like ipconfig and ifconfig to identify target IP addresses within the network.
- Launching Ettercap GUI with 'ettercap -G' and selecting network interfaces for sniffing traffic.
- Scanning the subnet for hosts and selecting target IP addresses for ARP spoofing.
- Enabling IP forwarding on Kali Linux to allow traffic relay during the man-in-the-middle attack.
- Capturing network traffic with Wireshark to analyze intercepted usernames, passwords, session IDs, and cookies.
- Discussion on how captured session data can be used for post-exploitation and further attacks.
- Encouragement to comment with questions and a reminder about ethical considerations in cybersecurity.
Full Transcript — Download SRT & Markdown
Speaker A
environment for host and from there on you can actually look out for Target systems and be able to launch address resolution protocol poisoning by broadcasting ARP of the Mac addresses and IP addresses into the network poisoning the Erp cache within those
Speaker A
AutoCAP is a tool available in Kali Linux that allows you to scan the entire environment for hosts, and from there, you can actually look out for target systems and be able to launch Address Resolution Protocol poisoning by broadcasting ARP of the MAC addresses and IP addresses into the network, poisoning the ARP cache within those systems.
Speaker A
many of those data into the hacker machine and then you can replicate those sessions and be able to perform a lot of post exploitation or post attacks so without further Ado let us get started on today today's tutorial so here I got
Speaker A
Immediately, you'll be able to perform a man-in-the-middle attack, and once you're in the man-in-the-middle, you can look out for usernames, passwords, session IDs, cookies, information, and you'll be able to copy and replicate many of those data into the hacker machine.
Speaker A
machine so whatever browsing information it is going to access into a server will be able to see it and be able to take note of the usernames passwords browsing and so on so moving forward we got the server
Speaker A
Then you can replicate those sessions and be able to perform a lot of post-exploitation or post-attacks. So without further ado, let us get started on today's tutorial. So here, I got VirtualBox running, and we got Windows 10 over here on one of the virtual machines.
Speaker A
and then from here on we will be able to actually conduct the ARP poisoning and from there we will be able to look into all the traffic going in and out of the client server so moving forward we are going into call
Speaker A
So I can enter CMD, and we can enter the ipconfig to see the IP address of the target machine. So Windows 10 is going to be the victim machine. So whatever browsing information it is going to access into a server, we will be able to see it and be able to take note of the usernames, passwords, browsing, and so on.
Speaker A
atticab Dash capital G it will boot up the user or graphical user interface of adaccap so once you're in ADI cab the first thing you go to is on the sniff so when you go to sniff you go into unified
Speaker A
So moving forward, we got the server running. So here, I have Metasploitable, and I can enter ifconfig. So ifconfig would actually tell our IP address of 192.168.1.10. So this is the target server. So we got a target victim, and we got a target server.
Speaker A
wireless it could be any of those interface so you have to choose them correctly so go ahead and click OK and this would be able to start up the unify sniffing on add a cap so moving forward the first thing we
Speaker A
And then from here on, we will be able to actually conduct the ARP poisoning, and from there, we will be able to look into all the traffic going in and out of the client-server. So moving forward, we are going into Kali Linux.
Speaker A
host list here we can see all the holes within your sub Network so here as mentioned earlier we got a couple of IP addresses that we are targeting so one is the 182 168.1.10 and we're going to add this as Target one and number two
Speaker A
So Kali Linux here is a virtual machine, and we can open up terminal. So from here on, we can zoom in a little so it's easier for you to see, and we can launch AutoCAP. So once you launch AutoCAP dash capital G, it will boot up the user or graphical user interface of AutoCAP.
Speaker A
current targets so from here you can see what are the targeting questions and of course you can begin your ARP spoofing however before we go there I'm going to launch a new window terminal and on a new window terminal because we
Speaker A
So once you're in AutoCAP, the first thing you go to is on the sniff. So when you go to sniff, you go into unified sniffing, and you indicate the network interface. So in this case, I only have eth0 as well as a local loopback.
Speaker A
are going to do is we can enter or you can go into cat slash Broc sys slash net slash ipv4 slash IP underscore forward and then if you hit enter you can see that the default value is zero because we want to start
Speaker A
So we are going to select eth0. So for your case, it could be a Wi-Fi, it could be a wireless, it could be any of those interfaces, so you have to choose them correctly. So go ahead and click OK, and this would be able to start up the unified sniffing on AutoCAP.
Speaker A
without a cap so once we have Wireshark launch we're gonna capture all those traffic on ET h0 so double click on it it starts to capture and how now what we're going to do we're going to add a cap and we go
Speaker A
So moving forward, the first thing we want to do is actually scan for hosts. So the great thing about AutoCAP is they will scan through the entire subnet or the network mask and tell you where all the hosts are. So if you go into the host list here, we can see all the hosts within your subnet.
Speaker A
information is being sent out into the environment to confuse the different IP addresses so once we have done that we are now poisoning the ARP cache of all these machines so what we're going to do is we're going
Speaker A
So here, as mentioned earlier, we got a couple of IP addresses that we are targeting. So one is the 192.168.1.10, and we're going to add this as target one. And number two, we're going to go to 192.168.1.19, and we're going to target this as target number two.
Speaker A
click login so once I click login immediately what happens is that because there is a man in the middle attack going on right now on call Linux and if you go into AutoCAD you can actually see here that we have
Speaker A
So we're going to add this to item two, and once you've done that, you can go into the targets, and you can look at the current targets. So from here, you can see what are the targeting questions, and of course, you can begin your ARP spoofing.
Speaker A
network and be able to launch the man in the middle attack using ARP poisoning of AutoCAD so once you do that you'll be able to use Wireshark to look up for all the traffic coming in and out in between
Speaker A
However, before we go there, I'm going to launch a new window terminal, and on a new window terminal because we want to be able to capture all this traffic with Wireshark. So we are going to change some configuration within Linux.
Speaker A
you have those cookie values that you can actually utilize to perform further attacks into the environment so I hope you have learned something valuable in today's tutorial and if you have any questions feel free to leave a comment below and I will try my best to
Speaker A
So the first thing we want to do is we are going to change the way how we are looking at the traffic. So what we are going to do is we can enter, or you can go into cat /proc/sys/net/ipv4/ip_forward, and then if you hit enter, you can see that the default value is zero.
Topics:EttercapARP poisoningman-in-the-middle attackKali Linuxnetwork sniffingWiresharkcybersecurity tutorialpost exploitationvirtual machinesnetwork security
![[정치포차Live] 인천광역시교육감 도성훈 후보_제9회 전국동시지방선거 — Transcript](https://i.ytimg.com/vi/zT0MUGjyGYs/maxresdefault.jpg)
