Hello everybody and welcome to this tutorial. This is part 3. Anyway, today
we're just gonna do a little bit more configuration, so just do commands. You
need to do this one so you need to make an adjustment to your firewall, and make
sure you have this port here, and port 80 here. You can follow through exactly
the same command as I have, except you need to change the interface here. And
you can see I've been testing this on my physical machine, so I've used the
wireless interface there, but here is the eth...one moment. Here it would be eth0,
and likewise you will adapt it to whatever your
markation for that interface that you are using is. If you
are using Kali Linux as I am for the purposes of this tutorial, and if
you have a default install, then you can type in exactly the same command as I
have typed in now with eth0. Anyway, don't need to reset the service again. In
addition to that command...where is it, excellent! So,
you will need to do this as well. I know that we've done this in the previous
tutorial, but I take it it we are doing it from scratch.
So it's echo 1, and just put it into ip_forward. I'm not gonna go too much into
this, or how you can check it, because I've already explained it in the
previous tutorials. Down below are just some scripts,
some of which we have downloaded from the net, and the rest you can download on
your own, if you wish. But, in any case, I want to actually get this
started, and before I can do that I just need to do the Apache configuration.
Quickly, nothing really special about that. You make this directory, so like
this, mkdir /var/www/tmp, press ENTER. OK, it cannot create the
directory because I have already created it, and down below is the
mod change for permissions, actually. You are changing permissions for that
directory, so nothing frightening there. It's just chmod 777, and make sure
that it's /var/www/tmp. That's it. The mod was already 777
there, but whatever, I'm just gonna do it one more time. Anyway, go ahead and clear
your screen. service httpd restart...oh, it's not htppd. Sorry, httpd is for
fedora. Here it's apache2, it's just the name of the package. Oh, come on...
there we go. It's gonna, yep, it's gonna restart. Anyway, it's gonna pop up a
warning, it says could not reliably determine this server's fully qualified
domain name. It doesn't matter, that's just a warning. You are not required to actually
set that up. The server will run just fine without it. Go ahead and clear the
screen, and we have squid that is running at the moment, as we have restarted it just
a moment ago, and now we need to conduct an ARP spoof. Here I've been conducting a
bit of ARP spoofing myself, prior to this tutorial, just to make sure
that everything works. I do believe, ah, there we go,
I have it. So type in arpspoof -i for the interface, -t for a victim, and
-r for a default gateway. Then just flip them around and, come on tell me I have
them flipped...I do have them flipped. Wow, this is amazing! Excellent! In the
previous tutorials I have explained why this is necessary, why you need to do
this. I know that my victims IP address is the last octet, that is 101. If
you don't know what it is just use nmap, and figure out which hosts
are alive on the network. Go ahead and press enter here, press enter here. The
ARP spoofing process is alive and rolling Go ahead and
click on your windows 8, well I'm using Windows 8.1 machine, you could be
using something else. Completely irrelevant what we are using, plenty of
operating systems out there. Now keynote here, these scripts are not always going
to work, and not all of them will work with the same things. So just read
through the files when you download them, read what they say, if
there are any readme files. Or, if it doesn't work with something, just type it
out on the forums, type it out on your favorite search engine, and you will see
that people before you have encountered similar problems, and you will
pretty much be able to see what is going on. I do need to show you something
with this terminal here...I need a large one. Tell me you're gonna increase...no, you
will not. Properties...oh, this is a cursor size.
Sorry, I need a font, a lot larger font, because I'm apparently blind. No, larger than
this...give me this. Excellent! So I'm just gonna clear the
screen here, cls is here, and this is how I know for sure that this computer is
ARP spoofed. This is something that I've been meaning to tell you, but I never
got around to it really. You type in arp -a for all, and press Enter.
OK, so this is one interface, another, another, we're not interested in those. We
are interested in this one. How do I know that I'm interested in this one? Well, you
type in ipconfig, and you have the names of the adapters here,
so ethernet adapter VirtualBox. So it's the only network, not that. I need
Ethernet adapter Ethernet, and that's gonna be 192.168.0.1.
I can't select things on this wretched CMD, but that is completely
inferior to Linux terminal, but what can I really do about it? Anyway,
type in arp -a, scroll up to the top, and you will see that there is an IP address
192.168.0.101. Now in the Linux we have been able to establish what is the
default gateway, and the default gateway is of course the same for all the
machines here on the same network. So, the default gateway is 192.168.0.1. That is
the very first IP address that you see. And right next to it, on the right side,
it says physical address, and then it says 90-f6-52-c1-bb-18. OK, so
that is our default gateway. Down below you have a, that's a
host computer, and below it is actually 104, which is supposed to be exactly the
same. Apparently, this is not our ARP spoofed.
I wonder why? Let's do ipconfig...it's still 101. Let's see if this is
gonna work, I don't know, let's just type in Google web search. Google Linux, it has
indeed added it, but why isn't it ARP spoofed? That is what I want to know.
arp -a, press enter...
This is quite strange. The MAC address
that are actually exactly the same. How? I have no idea. Apparently, it's not
registering it. Probably because it's a virtual machine. But, usually when I do 168.
0.104 it will have the same MAC address as the
default gateway. Why isn't it showing it here, I have literally no idea. But I'm
doing this segment for fun, anyway, so we're not gonna get into that too much.
Usually, it would show, on a physical machine, it will show here for some
strange reason. Maybe, that's just an assumption, I'm not too sure, because it's a
virtual machine that it's not showing. But, anyway, if you see that anybody on
your ARP list has the same MAC address as your default gateway, you know that
there is something the matter with it. You know that there is a problem, that
there's something going on, because the odds of that are,
well, actually non-existent. Because MAC addresses are regulated by manufacturers,
and it's not possible for two devices to have the same MAC address,
especially for two recent devices. Anyway, I'm going to go ahead and close
this frustrating CMD. And you see it says here Google, and let's just
go back to the msn.com. Anyway, my search query was Google, and if
I press web search...no, don't fix it. I don't want you to fix it, you
never fix anything. So, Google, I press web search, and the
page cannot be displayed.
Make sure HTTP...
ping google.com, does it work? Yes, yes, it does work. What is the problem? Why, why
Explorer, why? There we go. It is open now. Yeah, I just figured out why this is
happening. If you are performing this sort of an attack, your victim might, like
I have here, might experience slight delays or temporary loss of connection
for a couple of seconds, or something like that. I wouldn't call it a loss of
connection completely, it would just be unable to load a website from the first
try. But, instead of giving you the reload option here, apparently it just gives you
the fix problems, which it doesn't fix. If I was using Chrome, or something like that,
I've just got an option to reload the page. If you press reload the page it
will succeed, no problem. Now, my search query was Google, and on top of that it
has added a word Linux. How does it know which words to add? Well, simple enough, we
can go ahead and modify the script ourselves. So I am back in the Kali Linux
machine, and if I just do ls, my Google search is here, let me just
nano googleSearch.pl. Excellent! So it says extra text. Extra text is
Linux. I can put whatever I want there, it's completely irrelevant. I'm gonna put,
what am I gonna put? Smurf blue, lag, grey wall? I am running out of ideas. What am I
gonna put there? Six...let's put the number six. Just because I am completely
flushed out of ideas tonight. Anyway, if you wish multiple words you can
type in plus, and I can type in seven.
That's super original for my side. I am all original tonight. Note that this is
not actually six+seven, this is the word six and then plus seven. Let
me just think of something else. Let's type in brick, so six+brick, and then I
can type in space. Then I can type in blackhole, and then I can
type in +, I don't know, alcohol, or, I don't know. I have no idea. It
doesn't really matter. This is how you would add multiple words. So with a +
sign you can add pretty much as many words as you like. Eventually, there is a
limit somewhere out there, but nothing meaningful. You can add pretty much as
many words as you like. I'm just gonna leave it at six, not gonna bother, but you
can try and experiment. Type in different things and see what you get with the
results. Don't give it too long of strings because it might not work. Anyway,
Windows 8...oh, wait, I need to reset. Remember, once you change the
configuration files, or pretty much anything related to the configuration
files from which the configuration file takes something, such as this script,
because the configuration file is taking this script, you need to restart the
service. So service squid3 restart. Notice that also my ARP spoofing is going
on in the background, and I can just reset the proxy, the squid proxy, without
pausing the ARP at all, the ARP spoofing process at all. I'm not gonna do anything
to it, I'm not gonna touch it, I'm just gonna leave it running while the squid
proxy is actually resetting. And, I don't know, the last time it took maybe 30
seconds, something like that. This time hopefully it's gonna take a bit of a
shorter amount of time, and there we go. It's done, complete. Let's go over to
Windows 8. I'm going to close this, and let's
perform a web search. Why are you giving me fix connection, just reload the page,
and there we go. Once you press control + r, once you actually reload the
page, it's gonna work. So you see it says Google, and then it says Six. Anyway, that
would be it. Before I wrap this tutorial up, please let me urge you all to
experiment as much as you can, try all the other scripts that you can find.
But, please, and I mean please, do not just download a script from a random link
somewhere on the net. Don't do that. You have seen where I found the script, where
I've downloaded it. I mean you can find the script elsewhere, that's not a
problem, but be very specific with the place, as far as the places from which
you download the scripts are concerned. So you've seen I've downloaded it from
Google code, which is pretty safe, and plus I can actually read the script and
see what's written in it. And, you can in such a way be safer, but if you can't
read the script it doesn't really do you much good. Anyway, I'm
urging you, once again, be very careful from where you downloaded scripts, but
please do experiment as well. Try a lot of other varieties. One more thing to
say is that, you know, browsers are getting updated, there are security
precautions which are being put in place, so not all the scripts will work. This
attack won't work forever, and it won't work on all machines, and it won't work
against anyone. So please keep that in mind when attempting this. It's usually best
to go against somebody who doesn't have the latest updates, but that's a pretty
general sentence, and you might think that that's such a far-fetched idea, that
that's impossible. But, let me tell you something, most
people don't have the latest updates. They don't have the latest software.
There are multiple reasons for that. Sometimes it's money, but most of the
time it's just that people are lazy. They don't perform regular updates. And even
though it costs them literally nothing, maybe like five minutes of their time, or
something of a kind. Another thing is
that people are using operating systems for which the security support has ran
out. So there are no more security updates for those operating systems
which is fantastic. And you might think that I'm talking about Windows XP, or
something of a kind, no, I'm not talking about Windows XP. If you're using Windows
XP your machine is practically public property. Primarily
because, there are a lot of people out there scanning for those machines as
they are extremely vulnerable to all sorts of attacks. But, I'm talking more
about, for example, let's say Windows 7. OK, security support still hasn't ran out
but they're not exactly enthusiastic about it.
Windows 8.1 is fairly good with security but it still has some loopholes, and if
not updated regularly, on a regular basis, it can encounter problems. And even if it
is upgraded, I mean my system here it's upgraded.
This red flag that you see at the bottom, this is not the updates, this is just
telling me to turn something on for Windows that I don't want to turn on. I
think it's the windows default firewall, or antivirus, or something of a kind.
Anyway, that being said, I wish to bid you all farewell, and I hope to see you in
the next tutorial.
No comments:
Post a Comment