Hello everybody and welcome to this tutorial, this is part three.
Anyway today we're just gonna do a little bit more configuration.
So just do commands, you need to do this one.
So you need to make an adjustment to your firewall and
make sure that you have this port here, and port 80 here.
You can follow through exactly the same command as I have,
except you need to change the interface here.
And you can see I've been testing this on my physical machine so
I've used the wireless interface there, but here it would be eth, oops.
A moment.
Here it would be eth0, and
likewise you will adapt it to whatever you your operating system,
your markation for that interface that you are using is.
If you are using Kali Linux as I am for this for
the purposes of this tutorial, and if you have a default install,
then you can type in exactly the same command as I have typed in now, with eth0.
Anyway, [SOUND] don't need to reset the service again.
In addition to that command, [SOUND] where is it?
Here.
Excellent, so you will need to do this as well.
I know that we've done this in the previous tutorial but
I take it that we're doing it from scratch.
So it's echo 1 and just put it into ip_forward.
I'm not gonna go too much into this or
how you can check it because I already explained it in the previous tutorials.
Down below are just some scripts, some of which we have downloaded from the net and
the rest you can download on your own if you wish.
But in any case, I want to actually get this started.
And before I can do that I just need to do a budget configuration quickly.
Nothing really special about that.
You make this directory.
So, like this.
Mkdir /var/www/tmp, press enter.
Okay, cannot create directory because I have already created it.
And down below is the mod change for permissions actually.
You are changing permissions for that directory.
So nothing frightening there.
It's just chmod 777 and
make sure that it's /var/www/tmp.
That's it.
The mod was already 777 there, but whatever.
I'm just gonna do it one more time.
Anyway, go ahead and clear your screen.
Service httpd restart.
Oh, it's not httpd, sorry.
Httpd is for Fedora.
Here, it's apache2, just the name of the package.
Come on.
There we go.
It's gonna, yep.
It's going to restart.
Anyway, it's going to bump up a warning.
It says could not reliably determine the server's fully qualified domain name.
It doesn't matter.
That's just a warning.
You are not required to actually set that up.
The server will run just fine without it.
Go ahead and clear the screen.
We have a squid that is running at the moment,
since we have restarted it a moment ago.
Now, we need to conduct an ARP spoof here.
I've been conducting a bit of ARP spoofing myself prior to this
tutorial just to make sure that everything works.
And I do believe, here we go.
I have it. So type in arpspoof -i for interface,
-t for a victim, and -r for a default gateway.
Then just flip them around, and, come on, tell me I have them flipped.
I do have them flipped.
Wow, this is amazing.
Excellent.
In the previous tutorials I have explained why this is necessary,
why you need to do this.
I know that my victim's IP address is, the last octet is 101.
If you don't know what it is just use nmap and
figure out which hosts are alive on the network.
Go ahead and press enter here, press enter here.
The ARP spoofing process is alive and rolling.
Go ahead and click on your Windows 8, well I'm using Windows 8.1 machine,
you could be using something else, completely irrelevant what we are using.
Plenty of operating systems out there.
Now keynote here.
These scripts are not always gonna work, and
not all of them will work with the same things.
So just read through the files when you download them.
Read what they say.
If there are any readme files or if it doesn't work with something,
just type it out on the forums, type it out on your favorite search engine and
you will see that people before you have encountered similar problems.
And they will, you will pretty much be able to see what is going on.
So I do need to show you something with this terminal here.
I need a large one.
Tell me you're gonna increase.
No, you will not.
Properties.
Oh this is a cursor size, sorry.
I need a font, I need a lot larger font cuz I am apparently blind.
No, larger than this.
Give me this.
Excellent.
So I'm just going to clear the screen here.
CLS this here.
And this is how I know for sure that this computer is ARP spoofed.
This is something that I've been meaning to tell you, but
I just never got around to it really.
You type in arp -a, for all, and press enter.
OK, so this is one interface, another, another.
We're not interested in those, we are interested in this one.
How do I know that I am interested in this one?
Well, you type in ipconfig.
And you go to the, you have the names of the adapters here.
So ethernet adapter virtual box is the only network.
Not that. I need ethernet adapter ethernet.
And that's going to be 192.168.0.1.
I can't select things on this wretched CMD, but
that is completely inferior to the Linux terminal.
What can I really do about it?
Anyway, type in arp -a, scroll up to the top,
and you will see that there is an IP address 192.168.0.101.
Now in the Linux we have been able to establish what is the default gateway.
And the default gateway is, of course, the same for
all the machines here on the same network.
So the default gateway is 192.168.0.1.
That is the very first IP address that you see, and
right next to is on the right side, it says physical address and
then it says 90-f6-52-c1-bb-18.
Okay, so that is our default gateway.
Down below you have a, that's a host computer and
below it is actually 104, which is supposed to be exactly the same.
Oh, apparently this is not ARP spoofed, I wonder why.
Let's do ipconfig.
It's still 101.
Let's see if this is gonna work.
I don't know, let's just type in Google web search.
Google, Linux has indeed added it, but why hasn't it arp spoofed?
That is what I want to know.
arp -a, press enter.
Hm, this is
quite strange.
The MAC addresses are actually exactly the same, how I have no idea.
Apparently it's not registering it.
Probably because it's a virtual machine.
But usually when I do 168.0.104 will be the same,
will have the same MAC address as the default gateway.
Why isn't it showing here, I have literally no idea.
But I'm doing this segment for fun anyway.
So we're not gonna get into that too much.
Usually it would show on a physical machine, it will show here for
some strange reason.
Maybe, that's just an assumption, I'm not too sure.
Because the virtual machine that it's not showing.
But anyway, if you see that anybody on your ARP list has the same MAC address
as your default gateway, you know that there is something the matter with it.
You know that there is a problem, that there's something going on,
because the odds of that are, well, actually non-existent.
Because MAC addresses are regulated by manufacturers and it's not possible for
two devices to have the same MAC address, especially not for two recent devices.
Anyway, I'm gonna go ahead and close this frustrating CMD.
And you see, it says here Google and I've.
Okay, so I'll just go back to the MSN.com.
Anyway, my search query was Google and if I press web search.
No, no, no, don't fix it.
I don't want you to fix it.
You never fix anything.
So Google, I press Websearch and
the page cannot be displayed.
Make sure the http.
Ping google.com, does it work?
Yes, yes it does work.
What is the problem?
Why?
Why, Explorer, why?
There we go.
It is open now.
Yeah, I just figured out why this is happening.
If you are performing this sort of an attack, your victim might,
like I have here, might experience slight delays or
temporary loss of connection for a couple of seconds or something like that.
I wouldn't call it loss of connection completely.
It would just be unable to load the website from the first try,
but, instead of giving you the reload option here apparently
it just gives you fixed problems which it doesn't fix.
If I was using Chrome or
something like that I would just get an option to reload the page.
If you press reload the page it will succeed, no problems.
Now, my search query was Google and on top of that it has added a word Linux.
How does it know which words to add?
Well, simple enough.
We can go ahead and modify the script ourselves.
So I'm back in the Kali Linux machine.
And if just do ll, whoops, ls.
My Google search is here.
Let me just nano google search.
Excellent.
So, it says extra text.
Extra text is Linux.
I can put whatever I want there, it's completely irrelevant.
I'm gonna put, what am I gonna put?
Smurf.
Blue.
Black.
Gray wall.
I am running out of ideas.
What am I gonna put there?
Six.
Let's put the number six.
Just because I'm completely flushed out of ideas tonight.
Anyway, if you wish multiple words,
you can type in +, and I can type in seven.
That's like super original for my side.
I am all original tonight.
Note that this is not actually six plus seven.
This is the word six and then plus seven.
Let me just think of something else.
Let's type in brick.
So six+brick and then I can type in space.
Then I can type in blackhole.
And I can type in plus, I don't know,
alcohol, or I don't know.
I have no idea.
It doesn't really matter.
This is how you would add multiple words.
So with a plus sign, you can add pretty much as many words as you like.
Eventually there is a limit somewhere out there, but nothing meaningful.
You can add pretty much as many words as you like.
I'm just gonna leave it six, not gonna bother.
But you can try an experiment.
Type in different things and see what you get, the results.
Don't give it too long of a string because it might not work.
Anyway, Windows 8.
Oh, wait, I need to reset.
And remember, once you change the configuration files, or
pretty much anything related to the configuration files from which
the configuration file takes something, such as this script,
because the configuration is taking this script.
You need to restart the service.
So service squid3 restart.
Notice that also my ARP spoofing is going on in the background and
I can just reset the squid proxy without pausing the ARP spoofing process at all.
I'm not gonna do anything to it.
I'm not gonna touch it.
I'm just gonna leave it running while the squid proxy is actually resetting.
And, I don't know.
Last time, it took maybe 30 seconds, something like that.
This time, hopefully, it's gonna take a bit of a shorter amount of time.
And there we go.
It's done, complete.
Let's go over to Windows 8.
I'm gonna close this, and let's perform a web search.
Why are giving me fix connection?
Just reload the page.
And there we go.
Once you like press just Ctrl+R, once you actually reload the page, it's gonna work.
So you see, it says Google and then it says six.
Anyway, that would be it.
Before I wrap this tutorial up,
please let me urge you all to experiment as much as you can.
Try all the other scripts that you can find.
But please, and I mean please, do not just download
a script from a random link somewhere on the net.
Don't do that.
You have seen where I found the script, where I have downloaded it.
I mean, you can find the script elsewhere, that's not a problem.
But be very specific as far as the places from which you download
the scripts are concerned.
So as you've seen, I've downloaded it from Google Code, which is pretty safe, and
plus I can actually read the script and see what's written in it.
And you can in such a way be safer, but
if you can't read the script it doesn't really do much good.
Anyway, I am urging you once again,
be very careful from where you download the scripts.
But please do experiment as well.
Try, try a lot of other varieties.
One more thing to say is that browsers are getting updated.
There are security precautions which are being put in place, so
not all the scripts will work.
This attack won't work forever, and it won't work on all machines, and
it won't work against anyone.
So please keep that in mind when attempting this.
Usually best to go against somebody who doesn't have the latest updates.
But that's a pretty general sentence, and
you might think that that is such a far fetched idea that that's impossible.
But let me tell you something.
Most people don't have the latest updates.
They don't have the latest software.
There are multiple reasons for that.
Sometimes it's money, but most of the time it's just that people are lazy.
They don't perform regular updates and even though it cost them literally
nothing, maybe like five minutes of their time or something of a kind.
Another thing is that people are using operating systems for
which the security support has ran out.
So there are no more security updates for those operating systems,
which is fantastic.
And you might think that I'm talking about Windows XP or something of a kind.
No, I'm not talking about Windows XP.
If you're using Windows XP your machine is practically public property.
Primarily because there are a lot of people out there scanning for
those machines as they are extremely vulnerable to all sorts of attacks.
But I'm talking more about, for example, let's say Windows 7.
Security support still hasn't ran out but they're not exactly enthusiastic about it.
Windows 8.1 is fairly good with security but it still has some loopholes,
and if not updated on a regular basis it can encounter problems.
And even if it is upgraded, I mean my system here, it's upgraded.
This red flag that you see at the bottom.
This is not the updates, this is just telling me turn something on for
Windows that I don't want to turn on.
I think it's the Windows default firewall or antivirus or something of a kind.
Anyway, that being said I wish to bid you all farewell and
I hope to see you in the next tutorial.