Man in the middle attack using isa isa cap and explicable in this attack.
We can intercept the traffic between computers and router and I know that I did that before using some
basic stool like Cain and Abel and so on where we were able to capture the user name and password.
But here we're going to do it in an advanced way.
So our objective or our aim not just to capture the user name and password but to reassemble the pack.
So if someone sending an email I want to see what was the email contained what was the attachment.
It was a PDA.
Fine.
Let me reassemble it and let Mississippi file or ward file.
Well we want to see which Web site he went through.
What was the content of the website.
So it's much more deeper than the basic mechanism athletic.
We have two different tours.
As I mentioned ether cap it's a built in tool.
I mean you just to use a studio type ether cap minus kept geographic and get a g to get use a graphical
interface and it will start.
So you don't need to install it is already there.
You just type it down you get minus skeptically.
This tool will be used for intercepting the traffic it's a graphical tool.
Easy to use quite easy.
But we need another tool to analyze the traffic so someone will capture and another will analyze will
and we'll read a simple act.
And this is the exploit exploit tool.
And only if I'm pronouncing the name right or wrong explicit call.
Yes this is one explicit tool.
This is actually a forensic tool very very powerful tool but you may need to download it.
So what you need to do first you need to check in to the forensic.
So let me show you we're just going to increase the size.
And if you go to uh application here and go to forensic is it
forensic tool.
Uh as you can see explicit a split explicable tool it's Eric's play explicable.
Sorry if I'm not pronouncing it right.
Expert is is that if not you just need to google it.
Just type download explicable and open the explicable Web site and you're going to find some comment
here.
The first part you just take them copy and paste into your terminology takes the first one for instance
and copy it and go to the terminal.
And then and based it.
So you just need to follow those comments and it would be installed on your uh.
Kelly I'm sorry in your focus.
So Kelly Linux machine so check your uh check your menu first entered forensic tool if it's certified.
If not you just need to follow those steps.
It's quite easy.
So one side install it.
Let's see how to use both of them.
So what I'm gonna do right now I will first
run a circuit.
So let me just so I will not repeat that because it's already an install.
I was just showing you the steps that you need to follow if you need to install the store.
So now let's get back.
Let me close everything and start from the beginning.
So here I'm going to start a circuit minus kept agenda.
Forget it or keep it just for intercepting the traffic.
And here's what we're gonna do.
Will first to go to sniff and we're going to choose the first one
I keep increasing or decreasing.
I hope he's not disturbing you.
Just to show you in an easier way let me uh close.
Uh
said so the first thing we're going to do is to go and choose from sniffer tap unified sniffing and
I'm going to choose the network adapter from where it was.
I can sniff it for wired or wireless and then the manual expand.
So the second step would be going to host and I'll be going ask him to scan all scan for all hosts check
all the machine inside my network so he will scan all the machine inside the network depend on if you
choose the wired or wireless and he will give you how many machine has been found you can see that below
there.
Once you finish can you go to host one more time and you choose.
HOST Let's show me what you were able to get those out of the machines.
So what are gonna do right now it's important to know which one is the gateway.
And I believe from the previous lecture we were able to get Zippo gateways a gateway it's one in the
push to somebody choose a gateway and then click on Add to target one and then I'm going to choose my
victim.
Actually I have two different victim.
I have a Windows 7 and I have Windows 2003.
So I'm going to try both of them and see what is the difference.
So I'm going to start with Windows 2003 or lets those windows 7 click on it which is this is IP for
my victim and edit as target to.
And that's mean any traffic going between the router and the Windows 7 it's coming through the Kelly
Linux machine.
Once I finish I have to go to man in the middle attack and choose R poisoning.
We already explain what is are poisoning and choose the first option.
Now
click on okay.
What what is going right now that the computer isn't the Kelly Linux machine it's intercepting the traffic.
Now we can validate that.
Let me show you how.
So what we can do.
We can go to our windows 7 machine.
This is our windows 7 machine.
And first let's see if we have an internet connectivity here.
So I'm going to go there and I will open a browser and you can see that we have an internet connectivity
here.
Excellent.
The second part just to check if the traffic is intercepted or not.
Do you remember in the previous lecture I show you how or what was the real Mac address of my router
because when I typed R minus C. It showed me the router and the MAC address that it has been resolved
earlier.
So now let's do the following.
Let's do r Minus C. One more time and let's see.
Who's our mac address.
This was the MAC address before it starts with 0 0 5 0 and end up with VB.
Now let's do our minus a one more time and let's see if it has been changed or not.
So if you go
as you can see this is different than that one.
And actually this is the Kelly Linux machine.
So it seems that now the computer is the victim computer saying that Kelly Linux is a router so any
traffic that he sent to the Internet is going to the Mike Kelly Linux machine first.