Category: MiTM tools

Hello, aspiring ethical hackers. In our previous blogposts, you learnt what is sniffing and what is Man in the Middle (MITM) attacks etc. In this blogpost, you will learn about a tool named Ettercap. Ettercap is an open-source sniffer and a comprehensive suite for performing man in the middle attacks. With Ettercap we can perform both active and passive protocol analysis, data injection etc.

Let’s see how to use Ettercap for sniffing. For this tutorial, I will be using Kali Linux as my attacker system as ettercap is installed by default on it. As a target system, I am using Metasploitable 2 (see how to create a virtual hacking lab). Ettercap can be started in both command line and GUI. For this tutorial, let’s use the graphical version.

To start ettercap in graphical mode, start ettercap with the “-G” option as shown below.

sudo ettercap -G

The GUI version of Ettercap opens as shown below.

You can also open a network capture file (pcap file) using Ettercap. To start sniffing with ettercap, we have to click on the highlighted part as shown below after selecting the interface we want to sniff on.

As soon as you do this, Ettercap loads all its plugins and engines required for sniffing. By default, ettercap starts sniffing automatically. It can be stopped or started by clicking on the highlighted part as shown below.

Before you perform any attack, you need to know about all the devices on the LAN. Clicking on the tab highlighted in the image below makes this tool scan for all the LIVE hosts on the network.

After the scan is finished, ettercap adds the detected hosts.

The added hosts can be viewed by clicking of the tab highlighted below.

In our case five hosts have been added. I want to sniff the communication taking place between two machines. To do this, I right click on the IP of the client machine with IP 192.168.249.162 and add it as Target 2.

Similarly, I add the server machine with IP 192.168.249.149 as Target 1.

Needless to say, these two machines are the machines I want to perform sniffing on.

Then, I open the MiTM menu of this tool and select ARP poisoning as shown below.

This opens a new window as shown below.

I select “sniff remote connections” option and click on “OK”. This starts the ARP poisoning attack and all the traffic intending to go for 192.168.249.162 (client machine) to192.168.249.149 (server machine) will be sniffed. From the client machine, I make a telnet connection to target system.

Then on ettercap, I open the menu and go to view > connections.

This will show all the connections being made between client and the server.

In the above image, we can see one connection from IP 192.168.244.162 to port 23 of 192.168.249.149. Clicking on it will reveal the connection data exchanged between the two machines.

By default, the data from the client and server machines are shown in different tabs. You can see the credentials being exchanged between client and server. You can even join both the views for clarity.

Here, you can see the clear text credentials used to login into the telnet server.

Hello, aspiring ethical hackers. In our previous blogpost, you learnt in detail about packet sniffing and packet analyzing. A sniffer or a packet analyzer plays a very important role in packet sniffing. In this blogpost, you will learn about a sniffer or packet analyzing tool called tcpdump.

tcpdump is an open-source data-network packet analyzer that runs under a command line interface. It works on almost all Unix-type operating systems like Linux, Solaris, FreeBSD, macOS etc. Tcpdump was written by Van Jacobson, Sally Floyd, Van Paxson and Steven McCanne in 1998 while working in Lawrence Berkely Laboratory Network Research group. Let’s see how to perform packet sniffing with tcpdump. For this tutorial, we will be using Kali Linux as tcpdump is installed by default on it.

The command to start sniffing with tcpdump is given below.

tcpdump

if you are unable to start tcpdump with the above command, run tcpdump as sudo. On many UNIX operating systems, running this command requires SUDO privileges.

sudo tcpdump

As soon as you execute the above command, tcpdump starts sniffing on all the network interfaces connected to the machine. If you want tcpdump to perform sniffing on only a specific interface, you can specify the interface with the ‘-i’ option.

sudo tcpdump -i 

Depending on the number of devices connected to the interface, the packet analysis output may contain heavy or less traffic. To view traffic belonging to only one machine on the network, you can use the “host” option and specify the IP address. For example, let’s say we want to only see traffic belonging to device with IP 192.160.254.144 on the network. Here’s how to do it.

sudo tcpdump -i  host 

Let’s say you want to view traffic only that is originating from a particular device, you can use the option “src” for that.

sudo tcpdump -i  src 

Similarly you can also view only the traffic that is coming to the particular system using the “dst” option.

sudo tcpdump -i  dst 

We can also view traffic belonging to a specific part using the “port” option.

sudo tcpdump -i  port 

To write the output to a file, we have to use the “-w” option as shown below.

sudo tcpdump -i  port  -w  

To open the saved pcap file, you have to use the ‘-r’ option as shown below.

sudo tcpdump -r 

This pcap file can also be opened with Wireshark.

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail what is packet sniffing, types of sniffing, what are sniffers and types of sniffers? In this article, you will learn about Wireshark, the most popular sniffer used in cybersecurity.

What is Wireshark?

Wireshark is an open-source network packet analyzer that is used for network trouble shooting, network analysis etc. It runs on Linux, macOS, BSD, Solaris and even on Windows. It is installed by default in pen testing distros like Kali Linux and we are going to use the same for this tutorial. On Kali Linux, Wireshark sniffer can be started using the command “wireshark” in the terminal as shown below.

This will open the Wireshark GUI window as shown below.

In the newly opened Wireshark windows, all the network adapters attached to the system (in our case, virtual machine) on which Wireshark is running has are displayed. Select the network interface on which you want to capture packets (ours is eth0) and click on “Start capturing packets”.

Wireshark will start capturing live packets of the network. Here, it is time to learn about the interface of Wireshark. The interface of Wireshark can be divided into 5 primary parts. They are,

1. Menu bar: Common to all GUI applications and doesn’t need explanation.

2. The Main toolbar: The main toolbar consists of items for the operation of Wireshark. For example, like starting capture, stopping capture, restarting capture, saving capture to a file etc.

3. The Filter toolbar: The Filter toolbar is used to apply display filters for the captured packets. More about it later.

4. The “Packet List” name: This pane displays all the packets captured by Wireshark. These are separated by each line. By default, the “packet list” name consist of seven columns. They are,

• Number: The number of the packet in the capture file.
• Time: Time of capture of the packet.
• Source: The source from where the packet originated.
• Destination: The destination address where the packet went.
• Protocol: The protocol information about the captured packet: ex: ARP, ICMP etc.
• Length: Length of the captured packet.
• Information: Additional information about the packet.

5. The “Packet details’ pane: This pane shows the current packet in a more detailed form.

6. The “Packet Bytes” pane: This name shows all the details of the selected packet in style.

By now, you are accustomed to the interface of Wireshark. Let’s move forward. In the “packet list” pane, you can see all the packets. You can select each packet to see information about it. You can right click on each packet, to open a new menu too. For example, you can follow TCP stream of each packets. Well, there is a packet belonging to Telnet protocol going from 192.168.40.169 IP to 192.168.40.162. Following its TCP stream can be interesting. But you will learn about this in password sniffing.

The important concept beginners should learn about Wireshark is the Wireshark filters. If you see the Wireshark packet capture, it will be overwhelming if not confusing. Wireshark filters allow us to bring some clarity to the captured traffic. Filters can be applied to Wireshark from the “Filter” toolbar. Wireshark has some mostly used filters which can be viewed as shown below.

Let’s learn about some common filters useful to beginners. In the filter column, add this filter.

ip.addr==192.168.40.168

ip.addr==192.168.40.168

The default syntax of Wireshark filter is “ip.addr = = value”. For example, if you want to view the traffic of a particular IP address, this filter is used. Let’s say we want to view traffic of only the system whose IP address is “192.168.40.168”.

Let’s make it better. You want to view all the traffic originating from IP address 192.168.40.168 then the below filter will help.

ip.src == 192.168.40.169

Similarly, we can use “ip.dst = = 192.168.40.169” filter to see all the packets coming to machine with IP address 192.168.40.169. We can also combine two filters using ampersand (&&). For example, you want to view the packets originating from IP 192.168.49.169 and coming to IP 192.168.40. 168.using the filter below.

ip.src==192.168.40.169 && ip.dst==192.168.40.168

You can view even traffic belonging to a specific port in the entire network. For example, let’s view the traffic belonging to TCP port 21. “tcp.port == 21“ using filter as shown below.

tcp.port==21

Those are some helpful filters for beginners. At any time, you can stop the capture from the “stop capture” option of Wireshark as shown below.

You can also save the captured packets in a file. By default, Wireshark saves the captured data in the pcap format.

Ignore the warnings (-w)

By default, while scanning, it avoids going into any directories that are listable. This makes common sense too. It displays the message saying “directories are testable”. If you want it to scan inside such directories, you can use this option (-w).

We can once again open this pcap file using Wireshark again for analysis later. Learn how to use ettercap.