Original subtitles

Right so now we prepared our system we installed DNS mask and host APD and we connected our wireless

adapter we stopped the network manager we cleared any rules that might end that might interfere with

creating fake access point in the sector.

I'm going to show you how to configure dnsmasq so we can use it as a DNS server on a server and I'm

going to show you how to configure host APD so we can start the fake access point and allow people to

connect to it.

Now let's go to the first step and let's try to start our DCP server.

And that's also going to act as our DNS server.

Like I said because we're using DNS mosque which can be used to handle both tasks.

So to use the n as Mosque you need a configuration file.

I'm going to include this in the resources but before I just run it I actually want to explain to you

what's inside it because it's very simple.

And like I said I want you to understand what's going on inside these configuration files so that you

can adapt it to your own scenario.

So I'm going to right click this and I'm just going to open it with Jeanie so I can zoom in.

It's it's a normal text so you can open it with any text editor and I've added comments here to tell

you what each of these lines does.

So anything that's proceeded with the hash tag here means it's a comment.

It's not going to be read by the program it's just something it's just a way for me to tell you what's

this going to do.

So you can see the first line here sets the interface.

So I have that set two lines zero that's the name of my interface in here.

As you can see the name of my wireless interface

then we send the IP range that we can give to our clients and you can see that said from 10 0 0 or 10

to 10 0 0 or 100.

And each of these IPs can last for eight hours.

Then we said the IP of the gateway.

So that's going to be the IP of my land zero after I start the fake access point and that's going to

be set to 10 001.

And as you might know we usually use the first IP for the gateway or for the router then we set the

IP for the DNS server.

And again that's sent to 10 001 which is the IP of my computer the IP of the router in this fake access

point.

The last line here is very important and this will redirect any request that anyone makes on this fake

access point to the IP of the router to 10 001.

So we're redirecting we're using the hash tag here which means that we're redirecting any requests to

any web page to the IP of my computer.

Now if you look at the result of if Conficker right now you'll see that I still don't have an IP address

but once I start the network I'm going to configure it to have an IP of 10 0 0 1.

Now this is very similar to do an idea as spoofing attack but instead of using another tool to do that

we can just do it through the DNS server right here because we're going to be already the man in the

middle because we're already the people that's broadcast and the signal that's making the access point.

So I'm going to close it and I'm going to start DNS Musk.

So first in here I'm just going to clear this and then I'm going to do dnsmasq and then I'm going to

do dicy to specify the location where I have my configuration file.

And as you can see in here my configuration file is in home downloads fake AP.

So it's going to be a root cause in Cali home is set to route and it's downloads fake AP and the name

of my file is called DNS mosque dot com.

So we're doing dnsmasq dicy the location where we have our configuration file OK.

Now that got executed with no errors.

This means that now we have a DNS server and a DTP server running in the background as a service.

So if we go back to our slide in here we can see that we have steps two and three already done and all

we have to do now is just create a fake access point that's going to broadcast our signal.

So let's go back to the Kalya machine and before we start our fake access point I want to show you the

configuration file that it uses.

So just like dnsmasq it uses a configuration file.

So I'm to go right click it in here again.

I'm going to include that in the resources and I'm going to open it in junior so I can zoom in.

And as you can see in here it's a very simple file of just a few lines.

I have the comments here to tell you what each of these lines does.

And you can see now the first line is the interface that we're using.

And again I'm setting it to non-zero because that's the name of my wireless adapter.

The second line sets the name of the network.

So you want to send this to a name that's similar to the network that you're targeting if you're targeting

a cap to foretell or you need to set it to the same name.

If you're trying to target normal network with WPA encryption.

So in my case I'm doing this against the captor for it all and the name of the cup the photo was royal

Wi-Fi.

So I'm going to add this to the same name and I'm just going to call it Version 2 so that when people

get disconnected from the proper royal Wi-Fi because we're going to do the authentication attack they'll

think that there is something wrong with that network and then they'll try to connect to this one thinking

this is an updated version of it.

OK I'm going to save this the next line sets the channel that this network will be broadcasting on.

I'm going to leave it at one and the last line says the driver to be used for the interface adapter

and I'm going to leave it now.

Everything is done.

Again I'm going to close this and I'm going to start the host APD network by doing host APD followed

by the name of the configuration file.

So it's stored in root downloads fake AP and it's called Host EPD dot com.

And I'm also going to be to the end because usually when you run this command without the dash be it

will run as a command in the foreground and you'll have to open a new terminal window to run commands

from.

So I'm doing Dasch be at the end so that if I hit enter it will be executed at the background and then

I'll be able to run more commands in the terminal.

Now as you can see it's telling us that the network is working and it's broadcasting under the name

royal Wi-Fi version to.

Now finally I'm going to configure my last year on my wireless adapter to have an IP address.

I am going to set the IP address to 10 001 and then I'm going to said it's not mask.

So first of all the Figes do if configured zero now.

You'll see that it still doesn't have an IP address.

So we're going to do if config LAN zero we're going to give it an IP address of 10 0 0 0 1.

And I chose this IP address because this is the IP that I'm using.

Dnsmasq configuration as the IP address of the router is the IP address of the DNS server.

And as the IP address that all requests should go to then I'm going to do that mosque and I'm going

to set that 2 2 5 5 2 5 5 5 5 0 which is the default.

OK.

So we're literally just configuring our wireless adapter to have an IP address and we're set an Ethernet

mask as well.

I'm going to hit enter and we're done.

We're completely done.

Now we have our host a PDA running broadcasting the wireless signal.

So we have a network running with this name royal Wi-Fi version too.

We also started our DNS server.

So now we have any device that connects to our network.

We'll get an IP address and they'll be able to use that network.

Now the last thing that we need to do is start apache which is the web server that has the fake log

in page.

So we usually start apache by doing service Apache to start and that starts Apache for us.

Now let's go to a Windows machine and test this network and see if it actually works.

Now I'm going to go on Wi-Fi.

And as you can see we have two royal Wi-Fi networks we have the original one right here.

And we have the fake one now and proper attack scenario.

You should be running the authentication attack against this network so that nobody can connect to it.

And even the people connected to it will lose their connection.

So once that happens they're going to look for Wi-Fi networks and they're going to see a network called

Royal Wi-Fi version too and they'll just think this is an updated version of their network.

They're going to try to connect.

And usually when they connect they get an automatically they get a log in screen that looks similar

to what they usually do.

Now this is not going to happen right now and I will tell you why.

And I'm going to fix that in the future lectures.

But for now we're just going to connect to make sure that we can connect to this network and once we

connect I'm going to go and open my web browser

and just go to any web page.

So I'm going to go to being dot com.

Now once we do that as you can see we automatically got redirected to the logon page that looks exactly

like the logon page.

Our target users and they can just click English click on logon and then put their information and submit

it.

Now ideally we'd like this to be automatically displayed to the users as soon as they connect because

that's the default or the usual behavior of captive portals when you connect to it on an iPhone or on

a smartphone or even on a computer.

The logon page automatically gets displayed to you.

And we want our users to get the exact same experience so they don't get suspicious.

So what we've done so far is really good.

Now if you try to go to any Web site in here it's redirecting you to the log in page but the logon page

is not being displayed automatically.

Another issue if you try to go to a web page that uses hate as ts like Facebook for example the browser

will refuse to load it because it knows that this website uses Hastey CPS and you're not access and

it's used in Hastey CPS.

So it's showing an error.

That's another problem that might make people suspicious.

So we're going to address both of these issues later on in future lectures.

But for now as you can see we have a working network that has a name people can connect to it and anytime

they try to go to any Web site they'll be redirected to the logon page right here.