All language subtitles for 017 DNS Poising using Ettercap-subtitle-en

Now let's do a full attack using Issaka.

This attack will depend on intercepting traffic and changing the.

And before showing you the attack.

Let me show you a scenario.

So this is my vector machine.

It has a Windows 8 could be immobile it could be anything it has Windows 8.

And notice that when I tried to go to a specific Web site and this actually work on any platform.

So.

So let's if I try to go to a Microsoft Web site Canute's type in Microsoft

come.

Oh sorry my go soft so come so we have internet connectivity.

And when you type any website he's going to this Web site.

And if we try to ping on Microsoft dot come let me show you.

Microsoft IP.

So if I try to ping on this Web site to see if we have a connectivity with it or not.

My rule of thumb is pinging and so we have internet connectivity and this is the IP of Microsoft start

two one zero.

OK.

Now getting back to our candy Linux machine now we can intercept the traffic but we need to intercept

the traffic and whatever traffic will be intercepted it need to be modified.

And I'm going to focus on DNS traffic.

Now what is DNS exactly.

DNS is a service that change from name to IP.

I mean when you type Microsoft the router cannot understand that you have to translate that to Microsoft

IP to be able to reach it.

So what will happen if we poison's this IP if we change that right.

Or is the correct Microsoft IP put a fake Microsoft Web site.

Once the victim type Microsoft does come it will be translated to fake IP from Microsoft fake page and

the user will be taken to this fake page.

Let me show you how to do that.

But before doing that the only things that need some effort is a cap set.

If you need to apply those plug you need to do some modification.

So lets take Genest.

We're going to make a modification in DNS any DNS traffic it will be modified according to some rules

that we can implement right now.

So we need to go here into the it is so we go to other location and go to computer and go to ATC and

it says it is a folder called Issaka where this folder has all the configuration files.

So when you plan to implement some plug in some modification it'll be done according to the plan.

And as you can see you have like four or five our files that we can change is called insur DNS.

This is the file that we need to do some modification inside.

Now you can change from here but actually it's confusing me because the font is too big and I don't

spend time changing and so on.

So I'm going to repeat the step from the command line.

So I'm gonna open a terminal and you need to locate the file.

So the file name is easier not the.

And as and as you can see this is the location of the file.

So I need to modify from the command line you can do from the UI I I'm just showing you different option

now.

And you put the footbaths.

Sorry

copy and paste.

And he opens a fine.

Now it's not it's and it's readable file.

I mean you can read exactly what you need to change but let me brief you instead of let you search and

you need to go to a place that doesn't have those hash specially.

Or is it just one Microsoft that can or go through the record.

So here is thank you whenever someone inside the network is going to Microsoft I usually translate that.

Translate that to Microsoft IP and this is right.

Microsoft IP or the start of Microsoft to come I mean it could be Microsoft.

It could be portal of Microsoft the com or local or anything related to Microsoft syndicate to this

IP or that.

So what he's trying to say is that anyone is going to any Microsoft website or something related to

Microsoft's website it's redirected to the regular Microsoft upset.

Now what will happen if I change those IP and put another IP whoever to go to Microsoft to go to this

IP.

What if I change that and it put Facebook and I put fake Facebook page it will do the same.

Or Twitter or so on.

So it's not about Microsoft website it's about the concept.

So if this work you can change just Microsoft that come and put a fake Microsoft to page and the user

will never feel that he went to a fake page.

So let's see what I'm going to do right now as a proof of concept.

I'm going to whoever go to Microsoft would be directed to google for it.

So I need to open another terminal because I need to get Google IP.

So let's type ping.

W w w Google dot com and you'll see that the.

OK.

Control-C This is the Google ipe 0 8 1 1 7 2 3 1 1 8 7 excellence so I'm going to copy that.

Copy.

And I'm going to go here and we're going to change the IP and put the Google IP

is and then

beast and then

last one and based.

And we are set to go.

So I need to save this file.

So I'm going to click on control X and click on yes.

And now let's run Essar cap minus get algae and let's do the sense that the user care minus the G.

And let's follow the previous the step from the previous lecture with where I need to go to sniff and

choose the first one to identify which network I'm going to sniff the wire and wireless.

Then go to host and scan for host scan for host.

And sometimes you may need to do scan more than one time because you know he's not detecting all the

machine from the first time.

So it's better to do it twice.

But anyway I'm going to do it right one more time.

Scan for host.

And it seems that he finds five holes.

I know that there are five or six here.

And second step Z by doing more than one scan you get more machines so you have to repeat a couple of

times then go to host and go to a host test.

And as I told you need to identify it that way.

This is my gateway as target one.

And then I can identify is when the computer started to or I can keep all the machine to be DNS posing.

So I'm going to keep the remaining of the machine and then we'll go to MTM.

Now before going to Antium or before going to start sniffing we need to go to plug ins and Mohnish plug

ins and activate the Genesis poof which is the files that we did the modification in a few seconds ago.

So by clicking here and make sure you have a sign besides this plug in Jesmyn any traffic that will

be intercepted by this bicycle and Linux machine it will apply is the content of this file on it.

So I need to make sure that this one is active then going back to mennes amental are poisoning and choose

the first one sniffer remote connection and click on OK and then start and start sniffing.

And let's see if it going to work or not.

So going to my Windows 8 machine you remember a few seconds ago you were pinging on Microsoft and we

are getting a reply from Microsoft server and those are the Microsoft server IP right.

Let's think one more time on Microsoft see we are getting a reply from the IPs that we added to the

fine or not is or that is fine let's say to go to Microsoft to come refresh the page

sketch so we get too close and open it one more time.

My crew so the

Nagios you can see it has been redirected to Google.

But the amazing part that this still you are and has Microsoft.

So according to that if it's not about Microsoft and Google if you change the website from Microsoft

to Twitter or Facebook or any other Web sites that need credential and then redirect those request to

Facebook pages that look like exactly like those pages user will never or a victim will never feel that

it has been redirected besides creating a fake Web site.

It's quite easy in the hacking and droite section we're going to take a tool called social engineering

toolkit that is used for doing that in a few steps.

So it's not that hard to create a fake Web site and to activate a web server on your colonics and to

redirect the traffic.

So keep in mind this attack and then later on you're going to see how to as you said this attack with

another attack that we'll be taking in social engineering toolkit in Xandros section.