Hello everybody and welcome to this tutorial, today I'm gonna go ahead
and talk a little a bit about MAC addresses, what they are and why they
are important to us and how can we change them, this is all
in order to increase our level of anonymity, sort to put it.
You might among other things, you might notice that this is a bit of a different
interface and this is an updated version of this section.
There were a lot of people who had requested it so I figure I would update this
part with the Macchanger and simplified a little bit, also includes some
additional explanations.
Before we actually begin, let me just go ahead and delete my setup
I have a virtual machine running just as before, it is setup...
Yep, there we go, you can see this is a virtual machine
My host operating system is completely irrelevant in this case, it is
Fedora 22 but completely irrelevant, just note that this is a virtual
machine of Kali Linux operating withing virtual box and it does not
matter if your host is Windows or Mac, completely irrelevant
So just go ahead and open up the terminal, that is the very first thing that we
will need to do and let's go ahead and take a look at our MAC address here
ifconfig
Press Enter, and you will see that it says hardware address or burnt in address
there are multiple names by which it is referred so no big deal there
You can see that this is it, the first portion of it, the first three sets represent the
manufacturer
This is not the hardware address of my machine, this is the hardware
address of my network card, of my integrated network card
It can be either your ethernet card or your wireless card or your
wireless adapter, whatever
These things have MAC addresses and by them you can be identified
on the network
As I said, the first three sets identify the manufacturer of the particular
hardware in question so by just looking at the first three sets
you can search it on the net and see who the manufacturer is
just type it into Google and you will get a list of something like that
It doesn't really matter, you will get like a hundred thousand results
and you will be able to figure out who the manufacturer of that
particular card is. Now the last three sets, they're left to the will of
the manufacturer, they can do with them pretty much whatever
they want and you cannot utilize them yourself for any further
identification in that sense, so you won't be able to see which
device in particular is being used however, this MAC address is
visible on my local network and somebody can use it to
restrict access to completely ban me from the network or to
identify me, to identify me by name, that would be very difficult
but they would be able to, somebody who would be investigating
or the admin would be able to see this hardware address and
then if somebody takes a look at your laptop they would be able
to see the same address which is a problem because then there's a
direct link.
Now, they can be changed, they can be altered to your heart's content
which is very good news indeed, but please, keep in mind, just understand
that this address does not leave your local network, it does not go further
If was somewhere on the net out there on the internet I would not be able
to see this MAC address nor you will be able to see mine
this is only for local network, in fact, it does not leave the first jump in
your house, this network does not leave the default gateway
This address does not leave the default gateway which is your ISP router
so you can actually go to your ISP router, your ISP router has this MAC
address but it does not go any further than that, it stays there, so there is
no way for me to actually see it directly on the site
shenanigans sent went in to the router itself, grabbed it from the router itself.
Anyway, keep in mind that changing a MAC address in a virtual machine
is rather pointless I would say, but it is very useful if you have a USB
installation or a bootable USB or if you have this installed in your physical
machine and it is very useful in the real world to know how to do this
But since we have a virtual machine for learning purposes we are going to
use it as our test subject, and in the real world as you have mastered this
of course, you won't be using a virtual machine, you will be using a real machine
not to say virtual machines are useless. I'm not saying that the virtual machine
is useless, I'm just saying that we're using this one for learning purposes
and then in some later point of time when all of this is mastered you will
be able to switch to your bootable USB if you haven't already, or to a
physical machine.
But, the way to change an address is to, you can do this manually but
you can also use a macchanger, with a maccchanger you can...
It's a tool to change the MAC address, so let's go ahead and take a look
at this tool, type in maccchanger -h (h for help)
So the first option just prints this whole menu, the second one is gonna give you
the version, and this is gonna give you the MAC addresses, in fact, let's
go ahead and use this option so do the s
Ok fine, 'show', have I miss type something?
macchager -s eth0
Ok so I didn't pass the interface along, sorry If you type in ifconfig
and you can take a look at the interface or you know the interface
in advance, you can of course see the address here as well but if you
just want the macchanger to show it you would just use maccchanger
and type in the name of the interface here, you don't need this whole
thing, you just need that -s and there we go it says that the current MAC
is this one and that the permanent MAC is this one, the MAC address
so you might wonder, well why would I want to look at it here if I can
just type in ifconfig and look at it and take a look at it here, well,
when you change it you want to be able to see what is your current
MAC address and what is your permanent MAC address, so when the
MAC address is changed here in the output of the ifconfig you'll only
see the changed one, you won't be able to see the original one, so if
you want to see the original one you can have a look at it here
that's the permanent MAC, so no worries there, let's go ahead and
clear this, macchanger -h, there we go
And this is e, ending ''Don't change the vendor bytes'', ok fine, whatever
You're rarely going to use that, I mean, we're gonna go ahead and skip that really
There's no point, ''another set random vendor MAC of the same kind'', ok so this
is actually not a bad idea, sometimes, in some cases, so it says
"Set random vendor MAC of the same kind", so for example if on the network
only a certain type of devices are allowed from certain vendor you can
you can actually go ahead and change the MAC of your card and have it stay
within these parameters of the same vendor even thought it would be
a completely different MAC address.
For example, if you're in an office building or something like that and they only
allow certain hardware to go and function there from certain vender you can
go to that particular machine, it is possible to go if you have permission of course,
to that particular machine and actually change the MAC address and have it stay
within the confines of the same vendor so it will be a completely different MAC
and it will help in terms of anonymity and you will still have connectivity on the network.
But these are rather rare cases and again you won't actually need to use this one
This is -A ''Set random vendor MAC of any kind" that's pretty much self-explanatory
and this is an option which you will use as well, this is -p, quite important actually, it
will ''Reset to original, permanent hardware MAC'', it will bring about your original
MAC address if you've changed it or if you've changed it several times, it will
restore the original one on demand.
-r is just to ''Set fully random MAC'' address, this is something you're going
to use, so -p and -r are a good option, so this is a fully random MAC
and if you're wondering what the -A is, this will give you a random
MAC address, but this MAC address will be in the pool that has been
assigned to vendors so your network card will be identified as belonging
to at least some vendor as opposed to this, this is just a random set
completely random set, doesn't necessarily need to belong to any
vendor or anything like that.
What do I mean by that? well, -A, for example if you did this, like Realtek,
a company that produces network hardware, they have a fixed amount
of MAC addresses that have been given to them that they can use to identify
their devices and if you say -A for example, you might get the first three sets
from the Realtek and then the last three sets will be completely random again
so your card will be identified as being from Realtek as opposed to belonging
to some other company, and down below all six sets will be completely
random, so -A will ensure that the first three sets belong to a vendor
and then the last three sets are completely random with -r all the sets
are random.
Ok so this will print known vendors, you can type in macchanger -l
and there you go, so this are all known vendors there quite a bit
of them, and these are vendor bits, so the first three sets.
If you use the -A you will be identified as having a network card that
belongs to some of these vendors which is not a bad idea at all
You could actually use these bits to fake the MAC address of your hardware
as belonging to some of these vendors so if you want to pretend to be
a Belkin, you could use these bits to actually pretend to be Belkin,
if you want to be Netgear you could use these, so on and so forth.
I'm sure you get the idea here.
maccchanger -h
And in case of pretend to be a burnt in address, you can use that as well
but down below you have -m, and -m actually sets the MAC address
which is a very, very, very nice option, it can be extremely powerful,
if can have a tremendous effect, why? well, here's something that I will
share from... Well, it is my experience because I have seen it happened
and this keeps happening, there are tools to combat it
but, it's just the price and the amount of effort that you have to put into
fighting it, it's difficult, here's what I mean, let's say you are in a school
network,in some facility, some building, in a school during a lecture
during some of my lectures I've seen people, I've seen this done, let's put it
like that, basically we had these wireless projectors and people would,
in the beginning people would just jam the wireless and they noticed
and when they jammed the wireless the problem was that the professor's computer
could no longer connect to the wireless projector so the lecture was hinder
it was very difficult to perform because the connection would break every
minute or so and the professor didn't figure out, just figured ''oh, must be
some sort of technical problem or something like that!" then he went to the
administrator and administrators have taken a look at it and they realized they
were being jammed, so what they did was implement MAC filtering and
this caused further problems, why?, because anyone caught jamming
that MAC address would be permanently banned, however, someone came
with an idea and it's a fairly simple idea, it's a very old idea, they didn't
came up with it they just used it to actually scan the network, figure out
the MAC address of the professor's computer, take a look at it and then
set that address as their own address, so they take a look at his MAC address
they've taken it and then they've used the m option, the maccchanger to set
the interface MAC address of their own computers to be exactly the same
as the professor's and they begun doing shenanigans pretending to be
the professor's PC, what the administrators would do then is permanently
ban that MAC address which would create a very significant problem because
not only could he longer connect to the projector, not only the professor could
not longer connect to the projector, but, the professor could not longer
connect to pretty much any wireless network or any network at all within the
school facilities because on every router in the school that particular MAC
address was banned so this created an even bigger problem.
So now you see how the -m option can be extremely useful and extremley
powerful.
Anyway, I'm running a little bit short on time here so I would cut the tutorial
here and we would elaborate further on this matter in the follow-up tutorial.