Men in the middle attacks are very important network kind of attacks and before going further we need
to start with the basics.
And it's with the always eye layers.
We have seven layers corresponding to application presentation session transport network data link and
physical.
You can use the sentence.
All people seem to need data processing to memorize this layout and a better way.
The most important protocol we will discuss in this video is called the protocol which actually functions
at the data link to and it is responsible to translate the IP addresses from Layer 3 to MAC address.
The example would be giving under the mat in the middle that tax is the are spoofing or you can call
it as well are cash poisoning or are poisoning has various names.
So actually this is a technique by which the attacker sends poof our messages to a LAN.
Generally the aim of this attack is to associate the attackers MAC address with the IP of another host
such as the default gateway in most of the cases causing this traffic to be sent to this IP address
rather than the legitimate IP.
So in the normal situation if I am here Mr. Nice trying to communicate with the default gateway of the
IP wanted to us a one to one.
I don't have the MAC address of the default gateway so as you can see the message propagates from the
application layer to the physical layer and it should be translated At a certain point of time from
the IP address in the packets to the MAC addresses in the frames so the computer will need to know the
destination MAC address at a certain point of time before sending the data from the top down approach.
The computer will send the messages to the default gateway of this IP that I mentioned earlier.
So in order to know the next step which is the MAC address the computer sends an art request on the
network asking all the hosts on the network who has the IP address of the 1 to 1.
So the computer concerned were to play by its MAC address and this reply is cached on the Mr. Nice machine.
This is the situation under normal circumstances so in not normal or abnormal circumstances Mr bad who
is the malicious user here will have access to the network.
It's very important to have access to the network.
There was this attack only works this way.
It will have access to the network and you will send our pipelines saying that his mac address is associated
to the IP one to one and as well saying that his mac address is associated with the IP that's 1 to 2.
So as you can see there is no request for R but Mr Ban was able to send the reply.
This is a vulnerability in the protocol you don't need to have.
You don't need to be authenticated in order to send a reply.
So any host can just plug into the network and just send a reply to all the hosts on the network.
So in this case Mr Nice will cash this request with cash.
This message that the IP the one that one is associated with the MAC address that ends with nine eight
dash five.
As you can see on the next attempt to send the data to the default gateway that data will be redirected
to the computer of Mr Bath.
And actually this attack is used as an opening for other attacks such as denial of service men in the
middle attacks session hijacking attacks.
You can change the data you can monitor the data the data can be active.
It can be passive kind of like that of an attack.
As we said the protocol is the defacto protocol nowadays.
Communication and it has this vulnerability it's a status protocol where actually the natural course
will automatically cache any applies every set.
So they you catch any replies that receive regardless whether the death records requested them or not.
Even if the entries in the cache that are not expired they can be overwritten when you are reply back
it is receive as you can see anyone having access to the network can take advantage of this vulnerability
and just get or just drop the traffic to his mission.
This kind of attack actually has some legitimate uses in some cases.
For example in the especially in server field over cases some server can take on the traffic of another
server in case of a failure.
But this is not well used because it needs the dedicated tools to be employed in this video we'll see
how to do actually our opposing attack.
You go to the Windows machine which is the victim's machine and Type A P config to see that the default
gateway of this machine is 2 1 to 1 the 2 in order to get the MAC address of this default gateway just
at the command are minus 8 and you'll see that cached entries on this machine.
The first entry is the default gateway and the MAC address ends with the two.
So our attack would actually change this entry from G2 to a different bank which is called our poison.
We go to the Kali machine and open a terminal right.
I think we get the MAC address of this machine which is a malicious machine that will have access to
the network.
The illegal access of the network and will send fake R replies so as you see the MAC address and it
would be a good tool to do this are poised to attack is called Ito cap it's just sniffing and spoofing
it open the application press on the stiff menu and press on unified sniffing and select the interface
then you go to the hosts and press on scan for host.
So now this is scanning the hosts on the subnet that it actually resides on.
As you can see that for hosts have been added the host list if you want to see the host please just
press on the host again and post this menu as you can see it identified for both the IP address of our
target machine as one tonight so you select one tonight and press at 2 Target 1 so 1 2 right now is
our target.
Next is to execute that attack you go to the M.I.T. and Man at the middle menu and select our poisoning.
Then take the option only posing one way and select OK.
So now actually a fake our popular has been sent to our target sheet.
How to verify this.
You go to the victim's machine again and then you type the R minus a notice here the current cached
entry is d 2 for our default gateway.
So now the entry changed to 4 B which is the MAC address of the malicious machine.
So all the requests that are go into the gateway will now be diverted to go to the victims or to the
criminals or malicious users machine.
If you want to verify this you go to county again and you Fi and wire shark then you start sniffing.
Then you go here to the Times machine the victor's machine and just open web browser and is put to the
little page
and if you go here again you'll see that communication has been established and the traffic is being
redirected from one to nine to our machine shop the filter here just IP that source code for line
and this has all the traffic that's coming from the victim's machine.
If you want to verify real time just open this again minimize it.
OK.
And just look at another Web site
and you see the traffic being captured realtime.