During the section we will be talking about network attack and we're going to get to know and practice
some advance at network attack.
But before starting using that using different tool to implement network attack including many in the
middle and DNS poisoning and spoofing and different kinds of attack I would suggest that do not just
get to learn how to use the tool but it's very important to understand where is the weakness inside
your network.
Because if you understand the weakness you will be able to recommend solution.
But if you focus on how to use the tool which most of them are graphically and very easy to use you
will not be able to recommend any solution.
So I'm gonna start to explain how the network work and where are the weakness that most of the tools
that we can use depend on.
So when we work on a network and this network is connected to a switch and the switch is connected to
the router and router is connected to the Internet the router act as another means machine to the network.
Each machine inside the network including computers and routers have IP and MAC address.
So what happened is computer communicate together using IP while switches only understand MAC address.
So assume that this computer want to send an e-mail.
This computer is 1 9 2 1 6 8 1 5 and you need to send an email this e-mail to be able to go to the Internet
it need to go to the router and the router is connected to the switch and get an IP and also got a MAC
address.
So what will happen is if the computer tried to send the e-mail to the switch so the switch can send
it to the router and not send it to any other computer he need to specify this e-mail need to be sent
to which MAC address but the thing is that the computer only can communicate using IP.
So in the default gateway in the IP setting of this computer he knows that the Gateway which is the
router has this IP 1 9 2 1 6 8 or 201.
So when this computer will send the e-mail to the switch he will as he will tell him.
Could you please send this e-mail to the computer who got or is a router who got this IP 1 9 2 1 6 8
1 to 1.
This is the gateway.
The switch will it will receive the e-mail but he will not be able to forward this e-mail to each port
because he don't know the IP.
He only knows the MAC address.
So what he will do he will send something called an hour request telling all the devices connected to
the same switch guys.
Which one of you have this specific IP and you will send this to a destination MAC address which is
all f on f mean.
This is a broadcast.
So the switch will send to all the devices connected to it including the router every device except
the one from where he received our request asking those devices guys.
Which one of you got this IP because according to that if I know which one gets IP of 1 9 2 1 6 8 0
1 2 1 if I know that I'll be sending came this e-mail to be sent to the Internet.
This is our request sending a request to all the devices.
Ask them which one of you got this IP of 1 and 2 unsexy to 201 and
uh according to that one of the devices who got the IP will reply with something called our reply telling
them yes I am zones that you are looking for 1 9 2 1 6 8 2 2 under 1 and this is my mac address.
She is this MAC address.
And according to that the switch will will send this e-mail to the router and router would send it to
the Internet.
So it's all depend about recognizing device on the network using the Mac address.
So this is how our request and our reply work.
Now my question is consider the following scenario if this is an hacker machine.
Okay and Zack and machine when the switch sends the our request asking people which one of you got this
IP and instead of receiving a reply from the outer this computer who got a malicious software that spoof
the MAC address I mean figure symmetric MAC address will send to the switch telling.
Yes I am a router and this is my MAC address and he will send you the his own MAC address but he will
assume that he's the one who got this IP this switch has no way to validate that.
So what will happen is that he will send this e-mail to this guy and then the guy will take a copy and
will send it to the router.
This is what we called our spoofing.
We can also do our poisoning sometimes you can.
This computer no one sent on our request but he will send an ARP reply telling guys I am the router
but no one sent asking which one is the router.
So what will happen is that the Mac address tables that hold all the Mac This will be updated.
So it's not just when a device sent on our request.
He wait for our reply.
If you receive an R reply without sending an ARP request he will update the table and he will follow
any traffic to the hacker computer.
I hope I was able to explain a little bit how the manipulation is working using our request and our
reply.
But if it was not clear enough.
Once we start using the tool it will be more than clear.
Now let's see how to verify the ARP before doing the attack because later on you need to see if the
ARP has been changed or not.
So let's go to the Kelly Linux machine.
I mean let's go to our victim machine which would be a Windows machine it could be Windows 7 Windows
Server anything and let us see the configuration of this machine.
So we'll go here to
the command line
and will type IP config first to see the IP of this computer which is 1 9 2 and 6 8.
Let me just increase the screen for you
so the IP is 1 9 2 1 6 8 1 6 3 1 4 0.
And the gateway is 1 9 2 1 6 3 16 dot 2.
And we can type this comment.
Are minus E and this comment will show you our requests that has been sent earlier and the reply.
And as you can see this is very important.
And please give attention to that that request.
I mean since this computer has been used for the Internet before so definitely is the AAP has been sent
it before and a reply has been received.
And this is the Mac address of the gateway.
And this is because next time you don't need to send an ARP request and apply it it will be kept in
the cache.
So as you can see there are preserved.
And it's already saved.
And this is a real router Mac address.
So any traffic that I'm sending to the Internet it go to this router that has this Mac address.
What will happen is we're going to do an attack and we're going to check on the victim machine one more
time we're going to see that this MAC address will change to the hacker MAC address.
That's mean any traffic going from this machine is going to the hacker MAC address and the hacker will
be able to capture all this traffic and even re assembling reassemble them.
And this is actually quite serious.
So you are sending an e-mail.
You will be able to see what exactly is the email that you are sending.
So just getting the user name and password.
But he will be able to reassemble the traffic even in some cases if it was an attachment inside the
e-mail.
You can even opens attachment and see what is inside.
So this is a quite serious attack.
So let's see how to do that.