Instructor: Okay,
welcome to the man in the middle section.
This is where we can relax a little bit
since we covered all the important things
that an ethical hacker must know,
from scanning, from exploitation to gaining access
with Trojans and web application penetration testing.
Now, we can lay back and cover something that
you won't need that much
but it is a cool attack that allows you to
sniff information inside of a local area network.
Now, in network penetration testing
this is something that you also want to try.
In some networks there will be protection that blocks
this type of attacks.
However, to this date, many home networks, schools
and company networks don't have this applied.
Anyway, before we actually get to run this type
of the attack, let's first talk about how does it work.
Let's start like this.
Now, imagine a home network with many devices.
Say we have two computers and also our Cal Linux machine
inside of that network.
Networks also have routers that route their traffic
to different websites.
And every time that you, for example
communicate with a webpage, you do that through your router.
You request a webpage and a router will forward your request
to that server, and when the server sends a response to you
the router will send it to your machine
inside of the network.
But how does it know which machine to send to?
How does it know to who to forward which packet?
Well, let's explain it like this.
Let's go back to our three machines
and let's mark them with A, B, and C.
All of these machines, including our routers,
also have an IP address.
So we can say A has 192.168.1.10,
B has 192.168.1.5.
Our Cal Linux machine has 192.168.1.7
and our router has 192.168.1.1.
Besides having an IP address,
all of these machines also have their MAC address
and these two help them communicate
with each other over the network.
Our router knows who to forward the package to
thanks to ARP packets and ARP tables.
Now we are going to talk about ARP packets in just a second
but what I want to mention for now is that
our router has ARP tables that map every IP address inside
of the network with their MAC addresses.
Then it uses the machines MAC address
to forward the packet to them.
We know by now that MAC addresses are unique
therefore, by knowing them,
you know the idea of that machine
and then you can communicate with that machine.
Now let's explain those ARP packets.
What are they and how they allow us to communicate
with each other?
Well, to explain this
I will remove one machine just for the simplicity.
Okay, so there are two types of ARP packets.
We have ARP requests and ARP replies or ARP responses.
Now with requests, we find out what machine has
what MAC address and with ARP replies we reply to that
machine that ask the question with our response.
Requests would look something like this
let's say machine A wants to communicate
with our Cal Linux machine.
To do that, it must know our MAC address.
So it sends the ARP request to the broadcast address
which simply means every machine on the network
will get that ARP request.
And with that ARP request the machine A asks
who has an IP address, or 192.168.1.7.
And it also tells send me your MAC address
if this is your IP address.
In this scenario, our Cal Linux machine
receives the request and it gives an answer.
It says, I am 192.168.1.7
and here is my MAC address.
Now, this is just normal communication in any network.
This is how machines and our router
figures out to who they should forward a certain packet.
However, there are ways that this can be abused.
For example, what if I, from my Cal Linux machine,
raft an ARP response and send it to machine A saying
that I am 192.168.1.1, which is the router.
If we know that machine A uses router to communicate
with the internet, therefore once we send the machine A
and ARP response and tell it that we have an IP address
of the router it will start sending its packets
to us instead of the router.
For example, let's say machine A wants to visit Facebook.
In this case, it would send that Facebook request
to us instead of directly sending it to the real router.
Well, you might be asking what now?
We just managed to redirect the traffic of machine A
to go to us and now that machine won't be able
to access internet because the packets
are not being forwarded to Facebook or any other page
that they want to visit.
Well, not exactly.
We can also send an ARP response to the router.
In this response, we tell the router that
we are the machine A, now machine A believes
that we are the router and router believes
that we are machine A.
All we are left to do in this case is forward
the packets to keep the connection going.
So, in this scenario, instead of communication
to websites going like this.
Instead we spoofed the network and now the communication
is being done like this.
In this case, if machine A tries to visit facebook.com
for example it will send that request to us,
which we then forward to the router and router forwards it
to Facebook.
Like this we can snip the data if it is unencrypted
and we can also see what websites is machine A visiting.
And this communication works both ways.
Once Facebook receives machines A request
it sends the response that comes to our router
and then since router is also being spoofed,
it thinks that we are machine A
and it sends back the response to us.
Then we forward the response to machine A
so machine A has no idea that it is being spoofed
since it is able to visit any pages and websites.
This attack is called Man in the Middle
with the help of ARP spoofing.
And of course, when we perform this attack
and we spoof our router and targets
their ARP tables will look something like this.
The MAC address or machine A changes
to our MAC address inside of the router's ARP tables
and that is while it's being spoofed.
Once we stopped spoofing the MAC address changes back
to its real MAC address.
Okay, great.
Now that we know how exactly the attack works
let's mention a few things that we might want to get
once performing this attack.
The goal of it would most likely be to overall
be able to save the data going from other machines
on the same network.
We also want to be able to check out what websites
are other machines visiting, and if possible,
in case some communication is not encrypted,
we would want to sniff passwords
if someone tries to log in to some page.
Just most of these things depend on which websites
are they visiting.
Nonetheless, now that we know theory behind the attack
let's see how we can perform it using different tools.
See you in the next video.