Original subtitles

1 1

In the previous lecture, 2

2

we learned how to use BetterCAP 3

3

to run an ARP spoofing attack 4

4

and place ourselves in the middle of the connection 5

5

between a computer and the access point. 6

6

And every time I do this, 7

7

I keep saying this means that all the requests 8

8

and all the responses will flow through our computer, 9

9

which means that we'll be able to see anything 10

10

a user does on the Internet. 11

11

So we should be able to see the URLs, 12

12

the images, the videos, 13

13

the passwords they login with 14

14

or anything they send or receive. 15

15

So right now, we are already in the middle of the connection 16

16

and this data is already flowing through our computer. 17

17

So all we have to do is just use a program 18

18

to capture this data and analyze it. 19

19

Now we can use Wireshark to do that, 20

20

and I will cover this later on in the course, 21

21

but for now I'm gonna use a really nice module 22

22

that comes with BetterCAP, 23

23

that will automatically capture all of this data, 24

24

analyze it and show me the interesting stuff. 25

25

So all we have to do now is to tell BetterCAP 26

26

to capture all of the data 27

27

that is flowing through this computer 28

28

and analyze it for me. 29

29

And to do this, we can use the net.sniff module. 30

30

So you can do help followed by net.sniff 31

31

to see all of the options that you can set for this module. 32

32

But I showed you how to read options and change them, 33

33

so for now I actually wanna run it 34

34

without modifying any of the options, 35

35

so I'm just gonna do net.sniff on. 36

36

So now everything that's gonna flow through this computer 37

37

will be captured and analyzed by the net.sniff module. 38

38

So I'm gonna close this terminal window 39

39

and let's go to the target Windows computer. 40

40

I'm gonna open my web browser 41

41

and we're gonna generate some traffic 42

42

and see if that's gonna be captured by BetterCAP. 43

43

What we're doing right now 44

44

will not work against HTTPS 45

45

but don't worry, 46

46

we'll talk about how to bypass HTTPS later on 47

47

and why this won't work. 48

48

But for now, for testing, 49

49

I'm just gonna to a website called vulnweb 50

50

and I'm gonna include it's link 51

51

in the resources of this lecture. 52

52

So as you can see this is a normal website 53

53

that doesn't use HTTPS. 54

54

It also has a number of links here, 55

55

so if I click, for example, on this link, 56

56

everything is loading fine 57

57

as you can see here. 58

58

But if we go to the Kali machine, 59

59

you'll see that every request that we sent 60

60

was actually captured by this computer. 61

61

So you can do this to any computer 62

62

that is connected to the same network as you, 63

63

whether it's a wired or a wireless network. 64

64

So you can see there were requests sent to Google, 65

65

if we scroll down, 66

66

you will see we made a request 67

67

for this website, vulnweb.com. 68

68

You can also see all of the other files 69

69

that this website loaded. 70

70

So you can see we have a logo loaded here. 71

71

You can see we have a styles file being loaded here. 72

72

Again, if there were more images, 73

73

you'll actually see links to all of the images 74

74

that are being loaded. 75

75

You can see here this is the second link 76

76

that we clicked on, the testphp.vulnweb.com. 77

77

So this is what we have right here, here in the top. 78

78

Now also, let me just go back 79

79

and maybe click on the first one. 80

80

And as you can see, 81

81

this is another website. 82

82

It has the login functionality in here. 83

83

And let's try, for example, 84

84

login with a username. 85

85

Let's set the username to my name, ziad sabih. 86

86

And let's put the password as 1234567890. 87

87

I'm gonna click on Login. 88

88

Again, as you can see, 89

89

we got logged in, no issues at all. 90

90

But if I go back to the Kali computer 91

91

and scroll up, 92

92

as you can see, we captured a login 93

93

that was sent to this website, testhtml5.vulnweb.com. 94

94

Again, this is exactly the website that we have here 95

95

and if you look in here, 96

96

you can see that the username was ziad sabih 97

97

and the password was 123 all the way up to 90. 98

98

So basically the idea that I'm trying 99

99

to get across right now, 100

100

anything that the target computer sends 101

101

or receives right now will be captured by the Kali machine. 102

102

And like I said, we can do this to any computer 103

103

or any phone that is connected to the same network as us, 104

104

whether it's a WiFi or a wired network.