Now let's do the full attack one more time I open explicable as you can see and I'm going to log in
using user name explicable and possible explicable ex
and password explicable
remember and what we're gonna do before start a new case.
I will because I closed the user cap so let me restart Easter cap and let's go through the steps one
more time just to remind you first we go to sniff and choose the first one and choose the network adapter
unified sniffer and choose the first one then go to host and scan for host and we can wait until it's
can also hosts inside the network then we go to host list to show all the output host list and very
important to know which one is the gateways or the gateways this one at Target one and our victim is
1 4 2 0 and at 2 Target 2 then we go to man in the middle attack which was are poisoning and which was
the first selection.
Okay.
And then start start sniffing.
So I click on Start and click on starts now it's sniffing the network.
So once the traffic is getting sniffer it I'm going to go back to my application and we're going to
create here a new case and I will give it the name like uh uh man in the middle one.
Now you can do two things.
What you are doing right now it's life application but you can if you have some traffic that has been
captured with wire shark you can open that as well and be able to do the same issue by reassembling
the traffic and checking what has been sentenced on.
But what we are doing right now is life application so I'm gonna click on that and click on Create so
it create a case for us.
I'm gonna write a double click on it it would open then we're going to create a new session
and you name it whatever you want.
So I named this one for instance Destin
1 and create so I create the case then a decision I have decision here if I click on it this is the
station where all the traffic going from this specific machine which is zone to 7 machine will be captured
here but before starting I need to go to the interface here and choose which interface I will be capturing
from in our case we are forwarding the traffic from ITI 0 from the is on it but if you have a wireless
we can repeat for the wireless and we click on start.
So now the he listening to port 88 0 4 whatever is going so let's generate some traffic and let's see
what will be the output of this application.
So I'm gonna go here and I will go to my Windows XP Windows 7 and then let's open our browser uh let's
go to uh search for any picture for instant uh anything for instance the Paris
okay.
Now because this is when 2 7 and he's checking that the traffic is capturing so he will give you that
there is a certificate there but if you do that on a Windows Server 2003 or Windows XP it will not actually
give you this message and it depends on the browser.
I mean if you are using Windows 7 with some browser version you will also
don't give you any error.
So I'm opening Google and going to repeat the same attack to another operating system as well just to
see how it would go.
So let's type for instance Paris
and go to image for Paris.
So he's giving me some image to Paris.
Let's try New York.
Now maybe you are getting this message in the browser but what if you are sending an e-mail from Outlook.
You're not getting a message.
What you are you are fusing any other software.
It would be capturing or are using any voice over IP you're not getting any message.
Only some browser will give you some error that there is some certificate that it's not validated and
for regular user actually they are used to send such messages anyway.
But as I was saying if you're using a previous operating system you will not receive any message.
Now getting back to our machine here.
So as you can see all the traffic has been captured and you will be able to browse them.
Let me show you how.
So let's stop the capturing and let's see what we are getting.
So let me first try to increase the size of this.
So so he's showing you all the traffic you know the DNS traffic so.
And the e-mail if any e-mail has been sent to FTB different kinds of traffic and the amount of traffic
that has been ordered.
But this is not the point actually.
Let's go here.
Let's go to the web.
Since we only checked were pledged sees a Web site that I checked.
So if you click here on uh sorry web and you double click on site it will show you the Web site that
you searched you know so you can see that this is the link that to searching for Paris or New York or
Google or any Web site that has been checked.
If you go to for instant images it will show you all the images that has been browsed so you go showing
the bank images uh saying you can click here to show you image.
So it will even opens the page was the image.
If any image has been sent you can check here and see what you mean has been sent.
Voice over IP it can also capture the graphic e-mail or what made someone send the G.M. from measurement
his e-mail account or Hotmail account or from outlook it will intercept and it will rebuild the packet
or assemble the packets so you'll be able to see what has been sent.
You can see or you can capture the voice.
Someone is using Skype or any application it would be captured.
So the tool it's amazing actually you just need to start using it and
just see how effective it is.
It's more in to forensic.
But the point is that I can capture traffic and I can
reassemble the packet and see what has been sent and what has been received and all the traffic.
So it's not just capturing the user name or password I can get out of things.
Another good point which is I can use quite sharp because it's most more easy to use and saves the file
as a kept file and then retrieve the file here and be able to reassemble everything one more time.
So a very very powerful tool that allows you to do the men in the middle attack and intercept all kinds
of traffic reassemble the traffic see what has been sent and very very fit what I suggest to do.
It's using different virtual machine with different operating system.
Some of them old some of them new and start intercepting traffic.
One by one do not do all of them in the same time and see what you can get and what you can not get.
So this would be a good exercise to practice so is a cap and explicable too powerful tool for men in
the middle attack.