Original subtitles

1 1

Now, in this lecture, 2

2

I wanna show you how to run an ARP spoofing attack 3

3

using Bettercap. 4

4

This will allow us to place our computer 5

5

in the middle of the connection and intercept data. 6

6

Not only that, but we're also gonna see 7

7

how we can read this data. 8

8

So we can see all the URLs 9

9

and all the websites that the target visits 10

10

and we'll see everything that they post. 11

11

So anything any usernames, any passwords 12

12

they send to any websites, 13

13

we're gonna be able to capture them and see them. 14

14

So, first we need to become the man in the middle. 15

15

And we're gonna do this using a module called ARP spoof. 16

16

So if I scroll up to the help menu, 17

17

you can see we have a module here called ARP spoof. 18

18

So as usual, if we don't know how to use this module, 19

19

we're gonna do help arp.spoof, 20

20

because we want to see how to use this module 21

21

and see all the options that we can set for it. 22

22

So as you can see, as usual, 23

23

we can do arp.spoof on to turn this module on. 24

24

We can do arp.ban on 25

25

and this will literally just cut the connection 26

26

of the target. 27

27

This is very simple. 28

28

You can try it on your own time. 29

29

I'm not gonna do it here. 30

30

You can do arp.spoof off to turn it off 31

31

and arp.ban off to turn the ban off. 32

32

Now, in the previous lecture I also said 33

33

anything you see under the parameters 34

34

are the options that we can set for this specific module. 35

35

But I didn't show you how to modify that. 36

36

So in this lecture, 37

37

we're actually gonna be modifying some of these options. 38

38

Now as you can see, the tool is actually very helpful 39

39

because first of all it's given us the option name 40

40

in yellow here. 41

41

So these are the options that we can set, 42

42

that we can change. 43

43

And then it's also telling us 44

44

a description of what this option does 45

45

and the default value. 46

46

So for example, we can see we have an option 47

47

called arp.spoof.fullduplex. 48

48

You can see the description for this option 49

49

and basically what this option will do 50

50

if you set it to true, 51

51

it will spoof both the router and the target. 52

52

So it's similar to what we did with ARP spoof 53

53

when we executed the command twice 54

54

to spoof both the router and the target. 55

55

So if you set this to true, 56

56

both the router and the target will be spoofed 57

57

and you will be in the middle of the connection. 58

58

If you leave it to the default, which is false, 59

59

you will only spoof the target machine. 60

60

Now this can be useful 61

61

if the router has some sort of protection 62

62

against ARP spoofing attacks 63

63

because you won't to be interacting with router at all. 64

64

But it's also limiting because we won't be able to do 65

65

what I'm gonna do in the next lectures 66

66

because the router will communicate 67

67

with the target device directly. 68

68

So we won't to be able to inject stuff 69

69

in the responses that the router sends to the target device. 70

70

Now, I actually wanna change this to true 71

71

and the method I'm gonna do this 72

72

can be used to change any option 73

73

in any module in Bettercapp. 74

74

So not only in the arp.spoof. 75

75

If you're using any module, 76

76

you can do help followed by the module name 77

77

to get help about that module name. 78

78

You can see all of the options that you can set in here. 79

79

And then if you want to modify the value 80

80

of any of these options, all we have to do 81

81

is copy the option name, which is what I have right here 82

82

and type set, followed by the option 83

83

that you want to modify. 84

84

And in my case it's called arp.spoof.fullduplex. 85

85

And I wanna set this to true. 86

86

So very, very simple. 87

87

And like I said, you can use this command 88

88

to change any option in any module in Bettercap. 89

89

All you have to do is type, set, 90

90

followed by the option name, 91

91

followed by the value that you want to set. 92

92

So I'm gonna hit enter and that's done. 93

93

If you don't see errors, 94

94

that means it got executed properly. 95

95

The next option that I wanna change is the targets. 96

96

So again, in the description, 97

97

it's telling us that these are the targets 98

98

that I want to run the attack against 99

99

and I can use a coma if I wanted to target more than one IP 100

100

at the same time. 101

101

So again, just like what I did before, 102

102

I'm gonna do set, followed by the option name, 103

103

which is arp.spoof.targets. 104

104

And you can actually use the tab to auto-complete. 105

105

So if I just type T-A tab, 106

106

it'll auto complete the targets for me. 107

107

And after this I'm gonna put the value 108

108

that I want to set this option to, 109

109

which is the IP of my target 110

110

and we can get this using net discover, using zen map 111

111

or using the result that I got in here. 112

112

After I ran the recon module, I did net.show 113

113

and we got all of this, 114

114

which is the list of all of the computers 115

115

connected to the same network. 116

116

And my target right now, is this particular device, 117

117

the 10.0.2.7. 118

118

This is my windows virtual machine right here. 119

119

So I'm gonna put the IP 10.0.2.7. 120

120

And again, we don't see any errors, 121

121

which means that everything got executed as expected. 122

122

Now, we're ready to run the tool. 123

123

And again, based on the help menu that we got, 124

124

we can do arp.spoof on to turn this module on. 125

125

So we're gonna do arp.spoof on. 126

126

And perfect, as you can see, we see no errors. 127

127

It's telling us that the module is running. 128

128

And if I do help, again, we're gonna get a list 129

129

of all of the modules that are running right now. 130

130

And as you can see, we can see that ARP spoofing is on. 131

131

Also, it is very important that you make sure 132

132

that the net.probe and the net.recon are running. 133

133

We did this in the previous lecture. 134

134

That's why I didn't do it now. 135

135

So right now, Bettercap should be doing 136

136

what ARP spoofing was doing, 137

137

fooling both the router and the target device 138

138

and putting me in the middle of the connection 139

139

as shown here. 140

140

So, let's go to the windows machine right here. 141

141

And I'm gonna do arp-a and as you can see, 142

142

the routers MAC address right here 143

143

is the same as the MAC address for this device, 144

144

which is the 10.0.2.15. 145

145

And if I go back here to the Kali machine 146

146

and do ifconfig, you'll see this is the same MAC address 147

147

as the MAC address of the Kali ETH0 interface. 148

148

So basically, what this means is this windows machine, 149

149

every time it wants to send something to the router, 150

150

it'll send it to the Kali machine. 151

151

And because we set the full duplex option on, in Bettercap, 152

152

the router also thinks that this Kali machine 153

153

is the target machine. 154

154

Therefore, anytime it needs to send a response 155

155

to the windows machine, 156

156

it'll actually send it to Bettercap right here. 157

157

And like I said before, this means every username, password, 158

158

URL, anything the target computer sends or receives 159

159

will have to go through the Kali machine 160

160

where we're gonna be able to read it, modify it, or drop it. 161

161

And I'm gonna walk you through that in the next lectures.