ARP Poisoning | Man-in-the-Middle Attack

hey what's up guys welcome to serpros in this video we're going to be talking about arp [Music] poisoning before we start i need to stress that this video is for informational purposes only if you know how these attacks work then you can better defend against them do not try this on any system that you do not own or have permission to do so okay so before we dive into our poisoning let's first remind ourselves how app works so arp or address resolution protocol is used to discover mac addresses and then map them to an associated ip address the way this works is very simple let's say host a at the top wants to find the mac address of the default gateway which is 192 192.168.1.254 host a will broadcast a message to the entire network asking who is 192.168.1.254 and what is your mac address the message is sent to every device on the network host b sees this message realizes it's not for him and he just discards it the router however thinks oh that's me and replies saying here is my mac address and sends a reply to host a host a then stores this mac address alongside the associated ip address for future use in the app cache now if host a wants to send some data to this web server on the right it simply sends it to the default gateway which in our case is the router from here the router handles the rest now if this looks unfamiliar to you i have a video explaining this process in a bit more detail so feel free to go and check that out so that is how arp is supposed to work however there are some flaws to this process let's say host b isn't billy bob from down the hall he's actually an evil hacker trying to steal our information the hacker can send specifically crafted app messages to our host pretending to be the default gateway the idea is to poison host a's arp cache and trick it into listing the hacker's address as the default gateway so in this case host a replaces the mac address for the default gateway with the mac address of our evil hacker now if host a again wants to send some data to the web server he's going to look up the mac address in his arp cache the data will be sent to the switch just like before but this time the data is not sent to our router it's sent to the evil hacker instead the hacker can now do all the snooping he wants on the data before sending it to the real default gateway this attack is known as a man in the middle attack it's where the attacker places himself in between or in the middle of the victim and whichever system is trying to access if successful the hacker can inspect everything that is happening while the victim is none the wiser so that was the theory now let's see this in action here is our victim's computer before we do anything let's just check a few things if i go to start then type powershell move this into the center so we can all see first let's check the ip address and the default gateway to do this we'll type ipconfig here we can see the ip address of this machine which is 192.168.1.1 and our default gateway is 192.168.1.254 next i'm going to check the arp cache by typing up dash a here we can see the default gateway's ip address and the associated mac address so everything is working as it should let's now introduce our hackers machine this is kali linux kali is a linux distribution used for penetration testing or ethical hacking don't worry if you're not familiar with linux you can still follow along to get the idea the first thing i'm going to do is open the terminal and just like with our victim i'm going to check the ip address by typing if config as we can see this machine has an ip address of 192.168.1.2 we can also see the mac address here take a mental note of this remember it ends in d6 so now i'm going to open the menu go down to sniffing and spoofing then select eticap i just need to enter the root password and then click authenticate and i'll open this full screen okay so this is eticap and this is the program we're going to use to carry out our attack the first thing we need to do is select our primary interface if zero is correct so i'll leave it selected hit the tick button and eta cap will start up so now we need to find our targets the way we do this is by going to the three dots at the top of the screen select hosts and scan for hosts now it's going to scan for active hosts in my network we can see it found two active hosts to list the hosts we just need to go back to the three dots hosts and then host list we can see it has found 192.168.1.1 which will be our victim and 192.168.1.254 which is our router i'll first select our victim computer and add it to target 1. but for this attack to work we also need to trick the router into sending the traffic back to us and not to the real sender so we select our router and add it to target 2. now we need to select the man in the middle menu that looks like a little globe and choose our attack there are a few different options here but the one we want is up poisoning once selected you can see at the bottom that it has started the attack while that's running i'm just going to open a program called wireshark so we can capture some traffic i'll select the interface and then hit start capture back to our victim's computer nothing out of the ordinary seems to be happening here but if i open wireshark on this computer start capture we should start to see some strange arp messages we can make this easier to see by typing up in the filter box at the top of the screen now if we wait for a few seconds we should start to see those art messages claiming to be from the router on 192.168.1.25 but on closer inspection we can see the sender's ip address is the router but the sender's mac address is in fact the address of our kali linux machine remember it ends in d6 this is how we trick our victim forcing them to update their arp cache to use our mac address instead of the real one to see the effect this is having let's close wireshark and go back to powershell if i type up a again we will see the mac address for the default gateway has now changed to our attacker's address remember d6 okay so now let's pretend we are the unsuspecting user we open up our web browser and we browse to a website that is running http and we'll just use this basic wordpress site because this site is using http this means all traffic is sent unencrypted let's click login enter our username then our password and we're logged in nothing unusual happened right if we open our wireshark capture again and this time filter by the website ip address by typing ip address equals equals 10.10.10.10 take a look at the destination mac address does that look familiar to you it's the mac address of our cali machine this means all of the website traffic is being passed to the attacker let's go back to our attacker's machine one more time we are still capturing traffic from before what we can see here is all of the traffic between our victims machine and the web server we are simply intercepting it this means we can snoop through all of the data that is being sent for example i happen to know that wordpress login requests contain the field pwd so if i use the filter frame [Music] contains pwd we should see the post request if we then take a look at the html data we can see our login credentials that have been sent in plain text now if you don't fancy searching through huge amounts of packets then luckily eticap does a great job of extracting these credentials for us so that is how we can poison an app cache and trick a victim into sending us their data then we can extract passwords files and other confidential information and that's pretty scary right the good news is that this type of attack is nowhere near as dangerous as it once was the attack requires the data to be sent in clear text protocols such as http ftp and telnet that use plain text have all been replaced with much more secure methods it's a prime example of why you shouldn't use insecure protocols it's safe to say that 90 odd percent of traffic being sent over a network is now encrypted making this attack largely useless that said there are steps we can take to prevent this type of attack from happening in the first place in particular dynamic arp inspection also known as dai is more than capable of stopping this type of attack in a corporate network once again this video is for informational purposes only the more aware you are the more secure you can be do not try this attack on any systems that you do not own or have permission to do so if you liked this video don't forget to give it a thumbs up leave a comment and subscribe the support from you guys really does help this channel grow other than that thank you for watching you

Channel: CertBros

Views: 81,949

Keywords: arp poisoning, arp poisoning explained, arp poisoning attack, arp spoofing explained, arp spoofing, arp spoofing kali linux, kali linux, ettercap kali linux, kali linux tutorial, ccna 200-301, ccna training, cisco, cisco ccna, cisco networking, computer networking, computer networking course, networking, networking tutorial, address resolution protocol, arp

Id: A7nih6SANYs

Length: 11min 35sec (695 seconds)

Published: Tue Apr 06 2021