Hack Like a Pro: How to Spy on Anyone, Part 3 (Catching a Terrorist) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!Previously in my "Spy on Anyone" series, we used our hacking skills toturn a target's computer system into a bug to record conversationsandfound and downloaded confidential documents on someone's computer. In this tutorial, I will show you how to spy on somebody's Internet traffic.For the sake of making things interesting, let's assume we have a suspected terrorist that we need to keep eyes on because there is reason to believe that he is planning a terrorist attack (right out of last night's news!). Our employer (presumably a law enforcement, military, or espionage agency) has asked us to spy on his Internet traffic to see whether our suspicions are true. How can we do this?Step 1: Fire Up Kali & Access His NetworkOur first step, of course, is to fire upKali, our tried and trusted hacking toolkit. In it, there are numerous hacking tools. Before we can spy on our suspect we will need to place ourselves on the same network. This can be done numerous ways.First, if he is using a wireless network, this might be the easiest. We can eithercrack his WPA2 passwordorcrack his WPS PIN. In either case, after we crack the access code, we can then log into his AP to get on the same network.Second, we could physically place ourselves by the same network at his place of employment, school, institution, etc. We could pose as a new employee, new student, repair person, etc. and gain access to the network in that way.Third, we couldhack and own his computeroranyother computer on the same network. This might be the most time consuming and difficult. In any case, I am assuming you have access to the same network as the suspect, so let's continue with this tutorial.Step 2: Conduct a MitM AttackAlthough there are numerous ways to conduct a MitM (man-in-the-middle) attack, the simplest is probably using Ettercap, which is built into Kali and has both a command line and graphical user interface. To keep things simple, let's use the GUI. We can activate the Ettercap GUI by typing:kali > ettercap -GWhen we do so, it opens a GUI like that below.Step 3: Place Ourselves in the MiddleIn the next step, we need to place ourselves in the middle between the suspect and his router. The first step to doing this is to get Ettercap to sniff on the network. Go to the "Sniff" menu and select "Unified sniffing."Select the interface you want to sniff on. If you are on a wired network, it will usually be eth0. On a wireless network, it will usually be wlan0.Step 4: Scan for HostsThe next step is to scan for hosts. This means that Ettercap will scan the network and find the IP address and MAC address of all the systems on the network. From the "Hosts" menu, select "Scan for hosts."When Ettercap is done scanning the network, we need to select the "Hosts" menu again and select "Hosts list." Ettercap will now show you all the hosts on the network with IP addresses and MAC addresses.Step 5: Start the MitM AttackSelect the "Mitm" menu at the top of the screen. It will pull down several options. Select "Arp poisoning."Next, select your targets from the list of hosts. From the "Host List" tab, select the suspect as Target 1 and the router as Target 2.Now, we have successfully placed ourselves between the suspect and his router and all of his Internet traffic is traveling through our system!Step 6: Use Snort as a Spy ToolNow that have established ourselves between the suspect and his router, all of his traffic must go through our computer. This means that we can "see" all of his traffic. We could simply sniff his traffic with sniffers such asWireshark, but that would mean tediously filtering, scanning, and saving all of his traffic to look for suspicious activity. Our task would be much simpler if we could automate this process.Snortwas originally developed as an IDS to sniff Internet traffic and search for malicious activity. It picks up every packet and inspects it, using its rule base to look for traffic that might be malicious. It does this automatically and transparently with little human intervention.Here, we will alter Snort a bit. Instead of looking for malicious traffic coming into our network, we want to look for suspicious keywords coming from or going to the suspect's machine from the Internet. If any of these words appear in his traffic, it will send us an alert.The first step is todownload Snort, if you don't already have it. It can be found in the Kali repository, so you need only type the following. (If you have a recent version of Kali, it is already on your system, and you don't need to do this.)kali > apt-get install snortThis should successfully install Snort on your system.Step 7: Set Up Snort RulesSnort uses a rule set to look for malicious traffic. In addition, Snort allows us toadd our own rules. What we will be doing here is disabling all the rules that look for malicious traffic and instead creating rules that will look for suspicious keywords that might indicate the intentions of the suspect.We need to opensnort.confin any text editor. Here I will be using Leafpad.kali > leafpad /etc/snort/snort.confWe now need to navigate to the bottom of this file and comment out all the "includes" that pertain to the rule files. In my snort.conf, the "includes" begin at Line 570 with the local rules (yours may differ slightly). This will disable all the Snort rules that come with the IDS.Go through each line except the "include local.rules" one and place a#before each include. This will make certain that only our local rules are activated and used by Snort.Step 8: Write Rules to Look for Suspicious TrafficIn our last step, we need to create Snort rules that will search the suspect's Internet traffic for keywords that would indicate his intent of some malicious activity. This may differ based upon the circumstances, but I will set up alerts for whenever the suspect sends or receives traffic that contains the words, "jihad," "ISIS," "suicide," or "bomb." Of course, these keywords can and will differ, and I use these only for demonstration purposes here.Let's open thelocal.rulesfile in Leafpad and write the rules. For information on how to write Snort rules,check out this guide.kali > leafpad /etc/snort/rules/local.rulesWhen the file opens, add the file following rules as seen in the screenshot below.Now, save the local.rules file and start Snort.kali i > snort -vde -c /etc/snort/snort.confWhenever the suspect has any Internet traffic that contains those keywords, Snort will send you an alert and log the packet so that you can go back later and examine what he was looking at.We have successfully developed a spying system that will alert us whenever our suspected terrorist sends or receives any network traffic that contains those suspicious keywords. We may have successfully saved many innocent lives, my novice hackers, by simply applying some basic hacking skills!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedNews:News Clips - July 4How To:Prepare a survival kit for the event of a terrorist attack or catastropheHow To:Make a sneaky, snake spy camera that records videoHow To:Terrorist Cheatsheet Explains How to Avoid a Drone StrikeHow To:Force Switch to T-Mobile or Sprint on Project FiHow To:Make a motion triggered spy cameraHack Like a Pro:How to Spy on Anyone, Part 1 (Hacking Computers)News:Some of the World's Most Notorious Hackers Got HackedHow To:Watch This Sunday's 2013 Pro Bowl Football Game OnlineHow To:Turn Your iPhone into a Spy Camera Using Your Apple WatchHow To:Eavesdrop from a Distance with This DIY Parabolic "Spy" MicrophoneHow To:Take Slo-Mo Selfies (AKA 'Slofies') on iPhone 11, 11 Pro & 11 Pro MaxThe Hacks of Mr. Robot:How to Spy on Anyone's Smartphone ActivityHack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)The Sony Hack:Thoughts & Observations from a Real HackerHow To:Hack B29 Assault with Cheat Engine (09/23/09)How To:Catch Lake TroutHow To:The FBI Can Spy on Your Webcam Undetected: Here's How to Stop ThemNews:NYTimes Realizes That The FBI Keeps Celebrating Breaking Up Its Own TerroristNews:40 Years of NYC Being Destroyed in FilmsMinecraft Skyjacking:It's Terrorists vs. Counterterrorists in This PvP MapNews:Indie Game Mashup! DTIPBIJAYS + LSQOM = Scorpion Psychiatrists of SaturnRevealed:Hundreds of words to avoid using onlineNews:George Lucas Strikes BackNews:New cast member.How To:The Official Google+ Insider's Guide IndexHow To:Play Spy!Reel Moments:Make Time-Lapse Video on Your iPhone in Just a Few ClicksNews:John Brennan Takes over Counter - Terr. jobNews:Clinton meets with Gulf nations over missile defenseHack Like a Pro:Creating Your Own Prism ProgramNews:3 Long Awaited Indie Games at PAX That Should Be Released Already!Null Byte:Never Let Us DieNews:REVIEW - Day and KnightNews:House Approves Amendment To Limit Pentagon Drones Spying On AmericansTHE FILM LAB:Intro to Final Cut Pro - 02Edit on a Dime:The Week AheadNews:Terror suspect's eye color? Flying cameras to spy during Olympics9:fish Surfboards:Best Local Fish in LA