Hello everybody, and welcome to this tutorial.
Today, I will open up a chapter on attacking your home routers,
and not only home routers but routers in general.
Why is this important?
Well, routers are the first line of defense for any major network out there.
And if you can break into them,
you can generally do pretty much whatever you want on the network.
You can actually exclude people from the firewall rules on the network and
access them directly as well.
That can be a painful experience for anyone on the other side.
It can also change the DNS settings.
You can set up proxies or something of a kind, redirection of traffic.
You can serve them whatever information you want because, for
all intents and purposes, you are able to decide on what is what.
So when a router requests a URL, you can tell it it's on this IP address.
Or it's on that IP address.
Or you need to go here.
Or you need to log in here before you can go there, or whatever.
It provides for all sorts of shenanigans.
Now, before we begin, I would like you all to go ahead and open up your web browser.
You will need two websites, nmap.org and Exploit Database.
I have opened up both of these websites before, but
we haven't actually went over them.
We haven't actually used much from these websites,
from all the vast resources that they have to offer.
And if you wish to follow this tutorial through and do the things that I am doing,
you will need to modify your commands to an extent.
And you will need to just pay attention at what you are using, primarily because I
have a router that is set up in my home for the purposes of this tutorial,
that I have configured for the purposes of this tutorial.
But your home routers are likely to be different, and
provided, of course, that you own your own home router and
that you legally can actually do whatever you want to it.
Because not all telecoms allow that.
You can then feel free to play around with it and see what you can do.
You can lock it yourself, know the password, but
then you can try to break into it.
That's one of very good exercises.
Sometimes, you won't be able to break into it.
There simply won't be any vulnerabilities out there, and
you won't have a suitable target for social engineering or anything of a kind.
But, more often than not, what you are able to do is fool credentials from
the router, without actual authentication.
These are also some of the exploits that usually are referred to by link traversal.
And by modifying the URL requests of
the web server of the router, you are able to pool
certain information from it which ordinarily would not be available.
Now, a key thing to mention here is that it is a lot easier to
break into the home routers as opposed to breaking into
the routers of bigger companies whose networks are protected by such firewalls.
Primarily because those routers, and the companies, they are maintained.
Somebody takes care of them, somebody takes care of the updates, and so on and
so forth.
While, on the other hand, home routers, I mean, how many, be honest with yourselves,
again, and how many of you actually conduct upgrades or
firmware on your routers?
And usually there's one exploit.
If you don't update it, it's gonna stick around there for
a long line of years to come.
Also, if you are wondering, why should you attack home routers as opposed to
attacking, for example, companies, organizations, or something of a kind?
Well, if you are providing a pen testing service, and if you are attempting
to prove that the network is vulnerable of a certain company who has hired you,
you might not be able to attack it directly.
But you might be able to attack the employees' home routers,
where you can actually gather information on them, and
later on utilize that information in order to break
into the routers on the main network within the building of the company.
Anyway, as I said,
if you have permission from your home router, feel free to play around with it.
If not, then don't.
Feel free to buy a router somewhere for
20 bucks, something of a kind, and you can set up a pretty decent lab at home.
If you want to figure out what your home router's IP is, as before,
just type in route.
And after route, nothing really, just press Enter.
You will get default Gateway.
It's 192.168.1.1.
If you go ahead and copy that, I'm just gonna start nmap scan of it.
Nmap and paste this.
Give me forward boost output.
So while it's doing that, let's just go over to our browser, and
here I actually already have it up.
Here I've tried it, if I just reload it.
You see, it says here a username and
password are being requested at this IP address.
The site says, and
whoever made this router is a true genius, because it immediately gives me the brand.
Not only the brand, but it actually gives me the model number of the router.
I mean, this is a technique called banner grabbing.
Or at least it falls into that category, I would say.
I can just see the model number here in clear text, quite literally.
And of course,
when I know this, I don't need to perform some complex nmap scans to figure it out.
Rather instead, I can just do this,
> Copy > Cancel, and go over to the Exploit Database.
Click on Search.
It says here, Free Text Search, > CTRL+V > Search, and there we go.
It says CSRF Vulnerability.
Let's see what this one has to offer.
It says Introduction, TP-Link, Description of Vulnerability.
And look at the description, you can easily change the default user's
(admin) password by the default router page listening on port 80.
In here you the GET will change the password for you and
the POST request method is not needed for changing the router pass.
Excellent. So, through a simple GET` request,
you can change the default admins password, which is a bit ridiculous.
And here is all the, here is the exploit, and
here is pretty much everything that you need to do.
That's it.
Nothing, nothing else.
Here, it's completely described in how to implement it, and so on and so forth.
But, keep in mind, that just because there's only one
vulnerability with the exact specific name of this router,
that does not mean that that is the only vulnerability that applies to that router.
Always and always, this is a good practice.
Open up another window, type in the model number and
type in vulns, there we go.
Press Enter.
So okay, I have
CSRF Vulnerability
listed here, but
lets see this one.
What do we got here?
Excellent.
So here is another one.
It says Default Admin Credentials, web interface default, if you request,
there we go.
So this is, again, a modified URL request.
Let me just show you what I mean.
I would, of course, do this in a different manner, but for
the purpose of this tutorial, I'm just gonna do this manually, /rom-0.
Because I'm a genius who typed a dot.
Excellent, so it says problem loading the page, unable to load it.
But, see what I got.
I am able to download the rom-0 file and save it to my computer.
From that point on, I just need a program which would read through it and interpret
it for me to be able to read it and get the pass and get the credentials from it.
I will demonstrate this in the follow-up tutorial, but for the time being,
I just wanted to show you how you can banner grab, and then search.
And the places that you should search.
You see, it's not actually listed here.
It's probably listed under a different router name.
Probably just tp link td, but it doesn't matter.
So, in the follow-up tutorial, I will show you how we can break into this router of
mine, that I have set up for this tutorial, by utilizing the rom-0
download runnability, let's call it so, and actually reading from it.
We're gonna need some tools here in order to be able to interpret it.
In any case, I bid you farewell, and I hope to see you in the next tutorial.