Hack Like a Pro: How to Conduct a Simple Man-in-the-Middle Attack « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!Many of you have probably heard of a man-in-the-middle attack and wondered how difficult an attack like that would be. For those of you who've never heard of one, it's simply where we, the hacker, place ourselves between the victim and the server and send and receive all the communication between the two.It should be totally transparent to both the client and the server with neither suspecting they're connected to anything or anyone but who they expect. This allows us to see and read all of the communication (passwords, confidential information, etc.), as well as alter it, if need be.In this "Hack Like a Pro" tutorial, I'll show you a very simple way to conduct a MitM attack and capture unencrypted traffic.The Art of SniffingBefore we embark on a MitM attack, we need to address a few concepts. First, sniffing is the act of grabbing all of the traffic that passes you over the wired or wireless communication. There are a number of tools that will enable you to do this. Most famously,Wireshark, but also tcpdump, dsniff, and a handful of others.Enter Promiscuous ModeIn order to see and grab traffic other than your own, you need to first put your NIC orwireless adapterintopromiscuous mode(called monitor mode in wireless), meaning that it will pick up ALL traffic, not just that intended for your MAC/IP address. In wireless and wired networks with hubs, this can be accomplished relatively easily. In a switched environment, we need to be a bit more creative.Switches & SpoofingSwitches are designed to reduce network traffic and congestion by isolating traffic and only sending packets to a particular IP address or MAC address that's the destination, unlike hubs that send all traffic to all NICs. This means that my NIC only sees traffic intended for it, if the switch is doing its job. This makes it harder, but not impossible to sniff and thereby conduct a MiTM attack.To defeat the switches task of isolating network traffic, a number of strategies have been attempted. On older switches, you could flood them with ARPs and the switch would flood and fail open. These means that it would begin to act like a hub, sending all the traffic to all the NICs, enabling the hacker to sniff other people's traffic.This strategy no longer works on modern switches and even on the older ones, a vigilant network admin is going to notice the change in network traffic and volume.In order for switches to "know" where to send traffic, they maintain a CAM table that essentially maps IP addresses to MAC addresses. This table says that when traffic is intended for IP address 192.168.1.101, for instance, send that traffic to MAC address 11:22:33:44:EE:FF (example MAC address).If we can change the entries in that table, we can successfully get someone else's traffic. This is called ARP spoofing, because the entries in the CAM table come from ARPs that are sent out by the switch to gather this information from the NIC.ARP Spoofing for a MitM AttackWhat we will be doing here, is usingARP spoofingto place ourselves between two machines making the client believe we are the server and the server believe we are the client. With this, we can then send all the traffic through our computer and sniff every packet that goes in either direction.Hope all that makes sense! Let's get started with our MitM attack by opening upBackTrack!Step 1: Open Three TerminalsTo conduct this MitM attack, we're going to need three (3) terminals, so go ahead and open those now. Our goal here is to get a client on our network to believe we are the server and the server to believe we are the client.arpspoofcan do this for us by replacing the MAC address of the client and the server with our MAC address in the ARP table.Step 2: Arpspoof Client to ServerLet's start with the client. We want to replace the MAC address of the server with our MAC address.arpspoof 192.168.1.101 192.168.1.105Where:192.168.1.101is the IP of the client192.168.1.105is the IP of the serverIn this step, we're telling the client that we are the server.Step 3: Arpspoof Server to ClientNow we want to replace the MAC address of the client with our address, so we simply reverse the order of the IP addresses in the previous command.arpspoof 192.168.1.105 192.168.1.101Here, we are telling the server that we are the client.Now execute both of these commands. When we do this, the client will think we are the server and the server will think we are the client!Step 4: Pass Packets with IpforwardNow that we are impersonating both the client and server, we need to be able to pass or forward the packets to the other machine. In other words, we want the packets coming from the server to be forwarded to the client and those coming from the client forwarded to the server.We do this in Linux by using theip_forward. Linux has a built-in functionality to forward packets it receives. By default, it's turned off, but we can turn it on by changing its value to 1(ON).We simply echo a 1 and direct (>) it to /proc/sys/net/ipv4/ip_forward, thereby turning on ipforwarding.echo 1 > /proc/sys/net/ipv4/ip_forwardImage viawonderhowto.comNow our system, in the middle, is forwarding the traffic it receives to both ends of this connection, client and server.Step 5: Sniff the Traffic with DsniffNow that we have all the traffic coming from the client to the server and the server to the client going through our computer, we can sniff and see all the traffic!To do this, we could use a number of different sniffing tools, including Wireshark or tcpdump, but in this case we'll use Dug Song'sdsniff. Song designed dsniff to sniff out authentication information that appears on the wire in clear text (non-encrypted). So, protocols such as ftp, telnet, HTTP, SNMP, POP, LDAP, etc. can be sniffed off the wire.To activate dsniff, we simply type:dsniffImage viawonderhowto.comAs we can see, dsniff responds that it is listening on eth0.Step 6: Grab the FTP CredentialsNow, let's wait until the client logs into the ftp server. When he does so, dsniff will grab his credentials and display them to us.Image viawonderhowto.comAs you see in the screenshot above, dsniff has grabbed the ftp credentials of the administrator with the password of "password"! How easy was that!It's important to note that users and administrators often use that same username and password on all services and systems. Now that we have the admin's ftp password, the next step is to try to log in with it.In my next MitM tutorial, I'll show you how to sniff encrypted credentials off the wire, so keep coming back!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:Simple Man-in-the-Middle Script: For Script KiddiesHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyNews:Malware Targets Mac Users Through Well-Played Phishing AttackHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketNews:How to Study for the White Hat Hacker Associate Certification (CWA)News:Hello to the Null Byte Community!News:U.S. Justice Department Indicts Iranian HackersBecome an Elite Hacker, Part 2:Spoofing Cookies to Hack Facebook SessionsHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHow To:Add a Battery Meter & System Stats to the Information Stream on Your Galaxy S6 EdgeHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)How To:Hack LAN passwords with EttercapHacking Pranks:How to Flip Photos, Change Images & Inject Messages into Friends' Browsers on Your Wi-Fi NetworkHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Draw VegetaHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Use Trapcode plugins in Final Cut ProHow To:Build a Man-in-the-Middle Tool with Scapy and PythonHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHow To:Inject Payload into Softwares via HTTPHow To:Install iLok plug-ins for Pro Tools 8 in Mac OS XNews:Obama and Congress Approve Resolution that Supports UN Internet TakeoverNews:Day 2 Of Our New WorldVaccine bombshell:Baby monkeys develop autism after routine CDC vaccinationsNews:Afghan shooting raises questions about US course in countryNews:Indie and Mainstream Online Games Shut Down by LulzSecKick Ass Review Part 2:Gameplay and DesignNews:Afghan Slayings act of retaliation?News:Fantasia 2000 (2000)Shark Survival:Guide to Getting Out Alive