Scene 1

Man in The Middle Attack by Ettercap and DNS Spoofing

By : Ahmed  Khormi          Shatha Surayyi

Audio Recording Aug 21, 2021 at 12:02:04 PM

Scene 2

What is MITM attack? Ettercap ARP poisoning  NDP Poisoning  DHCP S poofing  ICMP Redirecting Target machine / target websites  Ettercap plugins

Audio Recording Aug 22, 2021 at 10:43:27 AM

Scene 3

A common type of cybersecurity attack.  Allows attackers to eavesdrop on the communication between two targets. Allow attackers to intercept confidential data.

A picture containing text, toy, doll, vector graphics

Description automatically generated

Audio Recording Aug 21, 2021 at 1:20:39 PM

Scene 4

Ettercap is a comprehensive suite for man-in-the-middle attacks. ARP Poisoning  NDP Poisoning DHCP  S poofing ICMP Redirect

Audio Recording Aug 21, 2021 at 7:54:26 PM

Scene 5

Audio Recording Aug 21, 2021 at 5:20:01 PM

Scene 6

ARP Poisoning  NDP Poisoning DHCP Spoofing  ICMP Redirect

Scene 7

Scan the range of the network using  arp -scan command

n -I ethl -l
Interface: ethl, type.
• ENIOMB, tuc: IPv4: 192.168.223.16
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
(Unknown: locally administered)
192.168.223.1 3e:22.
192.168.223.18
V%are, Inc.
2 packets received by
filter, packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.008 seconds (127.49 hosts/sec). 2 responded

Scene 8

Detecting OS for the  ip  addresses using  urlsnarf  tool

•sudol password for kali:
—l root '
-I -i ethi
.rlsnarf: listening on ethl (ttp port 80 or port 802 or port 31281
192.168.223.18 - - -ewe] http://certifiates.godaddy.wm}repositomtdig.'.crt HTTP/I.I' • •
' yicrosoft-cryptoAPI/1e
- - -ewe) http:/,'testph'.vul*b.cr,' HTTP/1.r - - 'https://—.google.w• (lindo.s 1
192.158.223.18
!.e) (KHNL, like Gecko) Chroæ/92.e.4515.131 safari/537.36 Ed!/92.e.R2.n•
- - -unj http://edge.'itroscft.ton/taptiveportal/generatau HTTP/I.I'- •
• •gozilla/5.e (Iir&s N
r 10.0) like Gecko) safari/537.36 Ed!/92.e.902.n•

Scene 9

(root* kali
# cat /proc/sys/net/ipv4/ip forward
1 > /proc/svs/net/ipvå/ip forward
(root •p kali
# cat /proc/sys/net/ipv4/ip forward
1

Scene 10

MITM using ARP poisoning –Ettercap- (4)

Scene 11

MITM using ARP poisoning –Ettercap- (5)

Host List
IP Auress
Targets
MAC
Ettercap
Description
192.1682231 198td4bt-c±4-4a6e-a4ac-ae7a59eSM4uoca1
19216822318
Delete Host
mer*-d (3 t%ts)—
L N%ts to Ynsts list.
2 Msts to
to Target
A$ to Tar

Scene 12

MITM using ARP poisoning –Ettercap- (6)

Graphical user interface, text

Description automatically generated

Scene 13

MITM using ARP poisoning –Ettercap- (7)

Scene 14

MITM using ARP poisoning –Ettercap- (8)

sniffing username and Password by  ettercap

Graphical user interface, application

Description automatically generated

Scene 15

MITM using ARP poisoning –Ettercap- (9)

root
pdump
/ home/ kali
listenang on ethO, I Ink-type ENIWMB (Ethernet), Sn'
524891 IP (tos ø.ø, tu 128, id 23924, offset O, f'
192,168.223.14.64384 > nags cksum
IP (tos ø.ø, 50, id ø, offset O, nags I
23.2.49.179.80 > 192.168.223.14.64384: Flags (S. 1, cksur
wscale 7), length
IP (tos Oxo, ttl 128, id 23925, offset O, f'
192.168.223.14.6t.381. 23.2.49.179.8ø; Flags ( . ) , cksum
IP (tos ttt 128, id 23926, offset O, f'
192.168.223.14.6438" > 23.2.49.179.8m Flags ( . l, cksum
IP (tos Ø•Ø, ttt 128, id 23927, offset 0, f'
192.168.223.14.6438'. > 23.2.49.179.8ø: Flags (P. l, cksur
GET
Connection: Keep-Ative
user-Agent: Microsoft-WNS/IO.O
Host: tile-service.weather.microsoft.com

I O 192.
S8%8
tool
*1ST
Ip-addr
sue
1988.
199'.
4319.212767M 192.
tu.21.2je
post
192 .168 223.14
4scss.eses37„ 192.168.223.14
18.192.fl2.3e
e n .pt-v
223 , 1'
192.168223.14
"use
urWcoded)
192, 168,223.14
tg.192.tn.3e
HTIPÆ.
, 698
( ss8.t
tuts).
698 (SSu
bit
, 11, src; Dst;
Internet Protocol Verswn 4, SIC: 192 _
, Src Port: hrt: 80. Seq: 1. ack:
text Transfer Protocol
'user Into. " HTTP.'I
Host:
Content
Origin:
Cmtent•ryß:
Sarari/S3t.3t
Lccept:
Referer:
OCOa ge
227219 •

Scene 16

MITM using ARP poisoning –Ettercap- (10)

Sniffing username and password using Wireshark

HTYL For. URL Encoded:
W' reshs
Accept -Encoding: gzip,
Accept-Language: en•US,
Full r uest URI: htt : // test h . vulnweb.con/userinfo.
reques
Res 199620
ex re uest n rare:
ea 02
80 oe
20 2f
13 65
31 2e
31 Od
48
74 3a
3a 20
69 76
32 32
61 67
72
73 65
75 72
65 2d
74 65
70 68
n 65
199614 etho
Cation'X f orm•urlencoded
Corn item:
Form item:
•uname"
testy
•pass" = •testl•
gapn
go 30
g86n
go 30
8880
gean
gahn
gt:clj
69
43
63
76
'e 6e 65
67
73
30
66
75
74
50
68
65
43
52 65 71
69
79
62
61
63
65
68
74
72
49
72
55
69
74
00
50
00
70
73
77
69
20
70
67
27
53
20
20
20
61
75
20
d6
54
74
63
74
64
65
20
76
54
65
65
43
61
73
68
75
54
73
65
61
78
6C
50
74
65
74
63
2d
49
73
74
ec
68
12
50
68
Je 2d 61
65
29
18
72
65
65
31
62
9- POST/
info. php
1 *ost:
. vulnweb
nnection
live
ngth: 22
Cont :
ade
cure •Req
Or Igin
'test hp
HTTP,'
: keep-
ntent •
uests:
Bytes 64: bit {eth.src.'g'

Scene 17

Host List
1921682231
Targets
Ettercap
192.16822i19
fd154b2952b100U&2C991026323
Delete
Delete
hosts added to the tistw
4 hostnames.
to TARGETI
added to TARGETI
added to TARGET2

Graphical user interface, text, application

Description automatically generated

Audio Recording Aug 21, 2021 at 6:13:01 PM

Scene 18

ARP poisoning victims:
GROUP I :
GROUP 2 : 192.168.223.19
NDP pisoning victims:
GROUP I :
GROUP 2 :

102068
Host;
Connect Ion:
Content •Length:
Accept:
User • Agent: VT W. e)
'537.36
Content • Type: Char •
aeriate.
Cookie;
btp_ 1
Oa:a
96 80
" •.00:01
onamc.
e. repo '
e• 004800).
Server: cle•udftare.
Content •Encoding:

Cancel
MITM Attack: NDP Poisoning
Optional parameters
e Sniff remote connections.
Only Pisonone-way.
0K

Audio Recording Aug 21, 2021 at 6:48:57 PM

Scene 19

DHCP spoofing occurs when an attacker attempts to respond to DHCP requests and trying to list themselves (spoofs) as the default gateway or DNS server.

Ca.nt
CYCP Respo,--se
R esp;nse
R"ue DHCP
DHCP Serve

Audio Recording Aug 21, 2021 at 7:35:13 PM

Scene 20

MVTM OHCP
8230 mac
Net mask
ONS
pts were starting upl
255255255-0
192.168.22112{
766 tcpos
_'182 s
'-darting sniffing.

—c root v kali'-l/home/kaliJ
etho: mtu 1500
inet 192.168.223.12 netmask 255.255.255.0 broadcast 192.168.223.255
inet6 prefixlen 64 scopeid

Audio Recording Aug 21, 2021 at 8:35:01 PM

Scene 21

Changing default gateway to the attacker’s IP

Text

Description automatically generated with medium confidence

Text

Description automatically generated

Step 3: the new gateway IP which is the attacker IP

Audio Recording Aug 21, 2021 at 8:46:40 PM

Scene 22

Audio Recording Aug 21, 2021 at 9:12:57 PM

Scene 23

Scene 24

A picture containing background pattern

Description automatically generated

Scene 25

DOS attack plugin Active remote-browser plugin

A picture containing diagram

Description automatically generated

Scene 26

Create dos-attack Ettercap filter to block the target

A screenshot of a computer

Description automatically generated with medium confidence

Scene 27

Compile Ettercap filter using  etterfilter

Scene 28

Scene 29

Send the visited  urls  from victim browser to the attacker by  ettercap

Scene 30

Audio Recording Aug 22, 2021 at 10:14:18 AM

Scene 31

Tool to capture pictures on the victim’s machine

Audio Recording Aug 22, 2021 at 10:13:08 AM

Scene 32

Arp poisoning the both side Perform MITM using Ubuntu machine and the target machine is Windows.

Audio Recording Aug 22, 2021 at 10:22:54 AM

Scene 33

Audio Recording Aug 22, 2021 at 10:26:18 AM

Scene 34

Using  dnsspoof  to change the IP of the website to the attacker’s IP

Audio Recording Aug 22, 2021 at 10:30:01 AM

Scene 35

Instead of the  ip  address for Facebook.com the user will get the  ip  address for the attacker machine.

Audio Recording Aug 22, 2021 at 10:36:53 AM

Scene 36

Scene 37

10 steps to prevent man in the middle attacks . Logsign. (n.d.). https://www.logsign.com/blog/10-steps-to-prevent-man-in-the-middle-attacks/.  7 types of man in the Middle (MITM) attacks hackers are using . Westpoint Recruitment. (n.d.). https://www.westpointcyber.io/blog/blog/types-of-man-in-the-middle-cyber-attacks.  Cisco learning network. (n.d.). https://learningnetwork.cisco.com/s/question/0D53i00000Ksumt/describe-dhcp-spoofing-attacks.  Ettercap home page . Ettercap Home Page. (n.d.). https://www.ettercap-project.org/.  E ttercap(8) - ettercap-common - Debian jessie - Debian Manpages. (n.d.). https://manpages.debian.org/jessie/ettercap-common/ettercap.8.en.html.  What is MITM (Man in the middle) Attack: Imperva . Learning Center. (2019, December 29). https://www.imperva.com/learn/application-security/man-in-the-middle-attack-mitm/.

Man in The Middle Attack by Ettercap and DNS Spoofing

Page 1 (0s)

Page 2 (15s)

Page 3 (51s)

Page 4 (1m 9s)

Page 5 (2m 32s)

Page 6 (3m 6s)

Page 7 (3m 35s)

Page 8 (4m 5s)

Page 9 (4m 48s)

Page 10 (5m 5s)

Page 11 (5m 21s)

Page 12 (5m 36s)

Page 13 (5m 48s)

Page 14 (5m 57s)

Page 15 (6m 15s)

Page 16 (7m 24s)

Page 17 (7m 55s)

Page 18 (8m 22s)

Page 19 (9m 10s)

Page 20 (9m 27s)

Page 21 (9m 54s)

Page 22 (10m 41s)

Page 23 (11m 2s)

Page 24 (11m 29s)

Page 25 (11m 41s)

Page 26 (12m 0s)

Page 27 (12m 22s)

Page 28 (12m 47s)

Page 29 (13m 19s)

Page 30 (13m 46s)

Page 31 (13m 57s)

Page 32 (14m 34s)

Page 33 (15m 11s)

Page 34 (15m 35s)

Page 35 (16m 13s)

Page 36 (16m 44s)

Page 37 (16m 59s)