Man-in-the-middle. ARP Poisoning. Hijacking connections. How does all of that actually work?
now especially if we're studying ethical hacking or learning about cyber security
these are going to be terms that we absolutely hear i'm going to show you how to do art
poisoning with a man in the middle attack but we're going to capture it with wireshark so
that you can learn how the protocols actually work instead of just pushing buttons on a tool
we're going to learn how these protocols actually do what they do so let's get to it
all right so arp poisoning with a man-in-the-middle attack to do that
we're going to use a tool called ettercap now if you've never used ettercat before
go ahead and go download it you can install it on your machine or if you have kali linux it's
already right there for you now here i have my two vms and on the right here i have my kali linux box
and on the left you can see i've just got a windows 10 machine so what i'm going to do
the windows 10 machine is going to be my target machine what i'm going to do is i'm going to
intercept traffic coming and going to this machine and i'm going to be able to do so by staging an
arp poisoning attack a man in the middle from the kali linux machine now both of these are
guest vms on my local system however if these were machines on a real connected cabled network
we could also do a very similar attack okay so to start off to look at how this is going
to work first let's take a look at my kali linux machine i'm going to do something up arp
dash a and what i'd like you guys to do is take a close look at the mac addresses that we see here
so here my system it can see three other machines it can see 3.15 and dot one well not one as our
default gateway so i want you to do is just pay close attention to those last four values that
we see here thirty five zero zero okay just trying to burn that in the back of your mind
also with dot 15 you can see there 27 cd that's the virtual mac address for the windows system
over here okay so just to be sure though let's go ahead and do an ifconfig so by doing an
ifconfig here i can see what my local address is on this machine on the kali linux machine so 2.4
all right so now that we have a bit of a lay of the land here on the cali machine let's go ahead
and go over to the windows box so i'm going to go ahead and just open up a command prompt
and what i'm going to do is come here i'm just going to do ipconfig
okay so here i can see that this is the machine that's 2.15
and if i do an rp-a here i can see the systems that this machine knows about at layer 2. these
are the other mac addresses that it's aware of so let's go and take a look at that first one 2.1
there we've got 3500 sounds familiar it was the same one that the kali linux machine knew about
and if i come to dot four there i can see 53 72 okay so this is a simple network only a couple
machines and a default gateway so now how does a man in the middle our poisoning attack really
work well let's go ahead and take a look so here i've got my windows 10 machine okay so windows 10
and he is aware of the router right he's already arp for that router this is dot one and that
router's responded so he's aware of what his mac address is in order for windows 10 to communicate
out into the internet and off this network it's very important that he know the mac address of
that interface so we saw that in the arp table now when he sends a message out and a message
comes back in this gateway needs to be aware of the mac address for the windows 10 machine
so that's already happened they've already arped they're aware of each other's mac addresses so now
those mac addresses can be used as the source and destination mac addresses in the ethernet
frame and we're going to see that in a little bit in wireshark so here's the issue if i'm on a
switch if i'm just on a network switch here so if i want to come in here like a hacker or hopefully
an ethical hacker and i want to intercept that traffic this is where i do my man in the middle
from but here's the thing about a network switch you see when the windows 10 box sends a message
over to the gateway the switch is only going to forward it out to this outbound interface the
switch already knows where that gateway is because it's already heard its mac address and updated its
cam table well the same is true in the opposite direction when the gateway responds when it sends
a message or a message comes from another network back to this windows 10 box that gateway then
sends it over and the switch will only send it out that outbound interface so if i'm sitting here
like an attacker if i want to be that man in the middle if i'm sitting here i don't hear anything
i'm only going to hear broadcast multicast and traffic to and from myself so i can't just plug
into the switch and just hope that i can capture the traffic to and from this windows 10 box
so in order to do so really to break the rules of switching if you will what i'm going to do is
i'm going to tell the windows 10 box that i am in fact the gateway and i'm going to do that with arp
i'm going to go ahead and tell the windows 10 box that i'm one and over here on the other side
i'm also going to send an arp packet over here to the router and i'm going to say hey i'm actually
15. so now both of these devices think that i'm the other one the windows 10 box thinks that i'm
the router the router thinks that i'm the windows 10 box okay so let's actually do this man in the
middle attack now let's actually see how we can use the edit cap tool to do that arp poisoning
so on kali linux before we bring up edit cap first i also want to make sure that you have a setting
in your system and it's an important one you see this system control net.ipv4.ip underscore forward
equals one this is a command that we have to enter into our system in order for our system
to actually forward traffic on otherwise if the windows 10 box thinks that i'm the gateway
i'm not going to forward that traffic on to the real gateway this is what allows that forwarding
to happen so this is an important thing we have to do before we kick off ettercap okay
so now that that's set i'm going to go ahead and close this i'm going to come up to my my uh drop
down menu and i'm going to type in header cap and i'm going to use the graphical editor cap for now
and while i'm doing this with editor cap something else i'm going to do in the background is do that
thing that we all came here to see and that's the wireshark stuff so let's go ahead and open up
wireshark as well okay so what i'm going to do in the background before i actually start to inject
those arps is i'm first going to capture them because i want to make sure that you understand
at the packet level how ettercap is doing that are poison so i'm going to come up here to ethernet 0
that's going to be the interface that i capture with i'm just going to double click it and now
i have wireshark running in the background all right so let's go ahead and just put this off to
the side all right so now with edit cap i go ahead and bring up editor cap and my primary interface
ethernet 0 that's the one i'm going to select and for right now i'm not going to do bridged sniffing
i only have one interface coming into this vm i don't have two interfaces packets coming in one
and going out the other it's all coming in and going out of the same interface so i don't have
to use bridge sniffing here all right so let's go ahead and check this all right so the first
thing that i have to do with edit cap is i need to tell it who the two targets are the windows 10
box and also the gateway so that it knows how to build that arp poison now to make this simple i'm
first just going to come up and hit the search key button that search thing and what that does is it
actually sends out a bunch of arp traffic scanning through the local subnet and then looking at what
systems respond so here i've got four hosts that were added to the host list now here's something
to think about if you're trying to be really stealth and if you're doing an actual pen test
that's something that you're not going to want to do you're not going to just throw out the fact
that you're arping the entire subnet that could trigger some alarm so just be very careful if you
use that search here in my little lab i don't care about that however if i was on a pen test
that's something that i would want to think about okay so let's go ahead and come up now to my hosts
here i can see what systems i have active now this is where i can configure my man in the middle
first i'm going to take a look at 2.15 remember that was the windows box that we have over here
that was 2.15 and i'm gonna come and make him target number one after that i'm going to come up
here to 2.1 and i'm gonna come over here to target number two all right so now i have my two targets
configured so now let's go ahead and set up that arp poison before i do that i'm going to come back
out here to my wireshark capture i'm just going to reset this just to make sure that i can see
i don't have to see all of those arps go and continue without saving come back to edit cap
now let's go ahead and come up here and this gives us our man in the middle menu uh just
for this video we're just going to look at art poisoning so let's come here go to art poisoning
and this is going to ask a couple questions so it's going to say okay sniff remote connections
only poison one way we can just leave this at the default sniff remote connections and hit ok
so you see here over here in wireshark we're actually able to capture these arp poison
attacks so what we want to do let's go and see if it worked i'm going to come back over here to
my windows box now remember before i thought that 2.1 was at 3500 that
was the mac address of my gateway but let's just take a look now let's go to arp dash a
and now let's take a look you see now 2.1 has changed now 53.72 or the editor cap box windows
thinks that that's the gateway all right so how did that happen well if i come here here i can see
let's go ahead and take a look at this first packet here let's actually take a look at the
packets that's that's going to be fun okay now i'm just going to come down here i'm going to select
that first arp that i see this is the first packet that went out when i actually did the attack okay
so ethernet 2 let's go ahead and take a look at these mac addresses so the source is coming from
the amount in the middle box and i'm sending it to 27 cd which is the windows 10 device all right
so that's the unicast from the man in the middle box to windows 10 this is an arp let's go ahead
and expand this and see what this looks like now here's the key if i take those if i take a look at
this down here this is an opcode reply or a two so this is what we call an unsolicited arp reply i'm
giving the windows 10 box an arp response that it never asked for it didn't arp for the gateway i'm
just telling it this is the gateway's address alright so let's just see how that works here's
my sender's mac address this is 53.72 so that's the man in the middle and i'm telling him hey
i'm 2.1 right so i know that your gateway is 2.1 that's who i am i'm impersonating him now i'm the
target this is windows 10 device and windows 10. well right after that check out what i do in the
opposite direction now if i come down to the next packet down this is where i can see i'm coming
from the man in the middle and i'm going to 3500 so this is to the gateway but check out what i'm
saying to him this is an a reply so again this is not an op code one that would be an arp request
instead this is just a reply who's sending it man in the middle this time i'm acting like i'm 2.15
so now i'm the windows 10 device i'm acting as if i was him so the man in the middle that's
how it does the arp poison is it sends these unsolicited arp replies in each direction to
the gateway and to the windows 10 device what that does is that breaks their arp table thinking that
i'm actually the gateway and the opposite in the other direction so let's go ahead and see if that
worked so i'm going to come down here remember before we weren't able to capture those ping
packets right so i'm going to scroll all the way to the down and i'm going to take a look at ping
dot google.com and over here now i can actually see those ping replies coming i'm capturing and
forwarding those pings through the man in the middle now let's see what else we can do
if i just open up microsoft edge over here let's open up a browser and let's do a little browsing
you can see over here on the right a bunch of traffic going by i'm capturing packets a lot
of black lines and red letters we're going to talk about that stuff on my channel don't worry
and if i come up here let's just go ahead and hit our favorite site
wireshark.org now here i am capturing the traffic passively this is how i'm able to execute a
man-in-the-middle poison attack i'm making windows 10 think that i'm the gateway and i'm making the
gateway think that i'm the windows 10 box so here my page loaded i was able to capture that traffic
and just for now what i'm going to do is run back to edit cap and i'm going to go ahead and stop my
man in the middle attack now just because we were able to do that right now with arps doesn't mean
that we're able to decrypt everything that we just saw everything that went by us especially those
tls sessions that we saw those are still encrypted but for the purposes of this video what i wanted
to do was show you how an arp poison actually works remember that you're sending unsolicited
arp replies in each direction and that makes each endpoint think that you're the other party
so if you like this video on a man in the middle attack and how an art poison actually works at
the packet level let me know go ahead and comment down below please like subscribe if you haven't
and we'll make sure to do more content like this in the very near future take care Packet People!
you