Original subtitles

1 1

[Lecturer] Now, in this lecture and the next few lectures 2

2

I wanna start talking about Man In the Middle Attacks. 3

3

These are attacks that we can launch 4

4

only if we are able to intercept 5

5

the communication between two devices. 6

6

Hence the name, Man In The Middle Attacks. 7

7

So a normal communication would look like this, 8

8

where the device is directly communicating with the entity 9

9

that they want to communicate with. 10

10

In a Man In The Middle Attack, 11

11

the hacker would be able to place themselves 12

12

in the middle of the connection, 13

13

allowing them to intercept and see anything 14

14

that is being transferred between the two devices. 15

15

Now, there are a number of ways to achieve this. 16

16

The first method that we'll cover in this course 17

17

is using an ARP spoofing attack. 18

18

ARP spoofing allow us to redirect the flow of packets 19

19

so instead of it flowing as shown in this diagram, 20

20

it would flow through my own computer. 21

21

So any requests sent and any responses received 22

22

by the target computer, 23

23

will have to flow through the hacker computer. 24

24

This means that any messages, any websites, any images, 25

25

any usernames, any passwords entered by the target 26

26

will have to flow through my computer. 27

27

This allows me to read this information, 28

28

modify it or drop it. 29

29

So as you can see, 30

30

this is a very serious and very powerful attack. 31

31

And the reason why it is possible 32

32

is because ARP is not very secure. 33

33

Now for us to understand how this works, 34

34

you need to have a basic understanding of what ARP is. 35

35

ARP stands for Address Resolution Protocol, 36

36

and it's a very simple protocol 37

37

that allow us to link IP addresses to MAC addresses. 38

38

So for example, let's say we have a network here, 39

39

we have devices A, B, C, and D. 40

40

They're all connected to the same network. 41

41

And we have the router here for this network. 42

42

We can see that each device has an IP and a MAC address. 43

43

Let's assume that device A 44

44

needs to communicate with device C. 45

45

Now we're also gonna assume 46

46

that device A knows the IP of device C. 47

47

But as we know so far, 48

48

in order for these devices to communicate 49

49

within the same network, 50

50

device A needs to know the MAC address of device C. 51

51

Because like we said before, 52

52

the communication inside the network 53

53

is carried out using the MAC address 54

54

and not using the IP address. 55

55

So this is a perfectly normal situation where have a client 56

56

that needs to know the MAC address of another client 57

57

so that it can communicate with this client. 58

58

So what this client does, it uses the ARP protocol. 59

59

What do I mean by that? 60

60

Basically, it sends a broadcast message. 61

61

So it sends an ARP request to all the clients on the network 62

62

saying who has 10.0.2.6? 63

63

Now all of these devices will ignore this packet 64

64

except the one that has this IP address, 65

65

which is 10.0.2.6, which is device C. 66

66

So all devices will not do anything 67

67

and the only device that will respond is device C 68

68

sending an ARP response. 69

69

In this response, device C is gonna say I have 10.0.2.6, 70

70

my MAC address is this MAC address. 71

71

This way device A will have the MAC address of device C 72

72

and now it will be able to communicate with device C 73

73

and do whatever task that it wanted to do initially. 74

74

So all of this communication 75

75

is facilitated using the ARP protocol. 76

76

Like I said, the ARP protocol 77

77

is a very simple protocol as you can see. 78

78

All it has is requests and responses 79

79

and the whole point of it 80

80

is so that we can link IP addresses to MAC addresses 81

81

or translate IP addresses to MAC addresses. 82

82

So a device can send a request asking for a MAC address 83

83

and then the device that has the MAC address 84

84

would respond with its MAC address. 85

85

So each computer have an ARP table, 86

86

which links IP addresses on the same network 87

87

to their MAC addresses. 88

88

So if I go on the kali machine and do ARP-a, 89

89

you can see my ARP table here and as you can see 90

90

it's linking the router's IP to the router's MAC address. 91

91

Now same if I go to the windows machine 92

92

and run my CMD and do ARP-a, you'll see again, 93

93

it's linking the router's IP to its MAC address. 94

94

So this machine, 95

95

anytime it needs to send any request to the Internet, 96

96

it will direct that request to this MAC address, 97

97

to the MAC address that's associated 98

98

with the IP of the router, which is 10.0.2.1. 99

99

Now this value in here, can be easily modified 100

100

by exploiting the ARP protocol. 101

101

So let me go back to my diagrams 102

102

and right here we have a diagram of a typical network 103

103

and you can see that normally 104

104

any device that's connected to the network, 105

105

if it wants to send a request, 106

106

it will send them to the router, the router will go 107

107

and send that request to the Internet, wait for the response 108

108

and then forward the response 109

109

to the device that requested it. 110

110

So if the hacker or the victim 111

111

or any other computer on the network 112

112

wanted to send a request, 113

113

they will send that request directly to the router. 114

114

Now what we can do is we can exploit the ARP protocol 115

115

and send two ARP responses, 116

116

one to the gateway and one to the victim. 117

117

We're gonna tell the gateway 118

118

that I am at the IP of the victim, 119

119

so the access point will update its ARP table 120

120

and it'll associate the IP of the target 121

121

with my MAC address. 122

122

We'll do the same with the victim, 123

123

so we'll send it an ARP response. 124

124

We're gonna tell it that I am at 10.0.2.1 125

125

so it's going to update its ARP table 126

126

and associate the IP of 10.0.2.1 with my own MAC address. 127

127

So the result of this, the victim is gonna think 128

128

that I am the router and the router is gonna think 129

129

that I am the victim. 130

130

So anytime the victim wants to send any requests, 131

131

the requests will have to flow through my computer 132

132

and I'm gonna forward them to the router. 133

133

And then anytime the access point or the router 134

134

wants to send responses, they're gonna go to my machine 135

135

because it thinks that I am the victim 136

136

and then I'm going to forward it to the victim. 137

137

So as you can see, 138

138

this puts me in the middle of the connection 139

139

and it gives me so much power 140

140

and we'll see all the things that we can do 141

141

once we become the Man In The Middle. 142

142

Now the main reason why we can do all of this 143

143

is because ARP is not secure. 144

144

Because first of all, clients can accept responses 145

145

even if they did not send a request. 146

146

So as I said before, 147

147

we're gonna send a response to the access point 148

148

and a response to the victim 149

149

telling them that I am at a specific IP 150

150

without them asking who am I 151

151

or without them asking for this IP. 152

152

I'm just gonna send the response 153

153

and they're gonna accept that response anyway. 154

154

Not only that, 155

155

well, they're also not going to verify who I am. 156

156

So when I say that I am a 10.0.2.7 157

157

I am clearly not at that IP 158

158

because this computer is at this IP. 159

159

But the access point will trust this 160

160

and it'll actually update its ARP table 161

161

based on the information that I sent. 162

162

Same goes to the victim. 163

163

I'm gonna tell it that I am at 10.0.2.1 164

164

it's gonna trust and believe this, 165

165

even though I am clearly not at this IP 166

166

because the access point is at this IP. 167

167

So these are the two main weaknesses with ARP protocol 168

168

that allow us to run ARP spoofing attacks.