Attacking Tools
4.6. Attacking Tools
4.6.1. Ethercap: Sniffing and MitM Attack
Ethercap is an open source program that combines a packet sniffer for different protocols (POP/HTTP/HTTPS/SFTP), but it also offers password cracking features.
Steps:
In order to start Ettercap, let us run the following command in out terminal:
The -G
options instructs Ettercap to use GTK+ GUI, in other words, it instructs Ettercap to start the graphical interface.
Select the interface to use and the sniffing option We can choose between:
Unified : it sniffs all the packets on the cable
Bridged : it uses 2 network interfaces and forwards the traffic one to the other
Once we select the sniffing option (unified in our case), a new window appears Here we have to select the interface to use. In our case we will select the
tap0
interface and clickOK
. Once we confirm, the options and the interface will change.Right now Ettercap is sniffing the traffic on the network. You can see the connection intercepted by clicking on
View
and then selectConnections
The first step once we run Ettercap is to scan the network in order to find alive hosts
This is the easiest step, but may take a while depending on how your network is set up. To do this let us click on Hosts
and then Scan for hosts
.
It will go through its automatic scanning steps while showing you its progress.
Once it is done, we can see the results by clicking on
Host list
in theHost
menu
From here we can select which of these hosts will be the targets of our attack. We just need to select them and then click on Add target 1
and Add target 2
While you can pick as many hosts as you like, remember that your system will be processing the traffic from the hosts you select. In other words, be sure to not to select too many hosts or everything will come to a standstill.
Try 2 or 3 targets at the beginning and add additional from there if you wish.
Supposing we want to intercept only the traffic of a specific host, we will add the target host and the router in the list.
Therefore, if we want to run our attack on the host with IP address 172.16.5.15, we will select the targets as follow: Add to target 1: 172.16.5.15 | or | Add to target 1: 172.16.5.1 Add to target 2: 172.16.5.1 | | Add to target 2: 172.16.5.15
Important: Please note that if you do not select a target, Ettercap will automatically set ANY (all the hosts) in the target list.
Once we set the targets, we can select the type of attack to run. To do so let us click on the MitM in the top bar and choose among one of the following attacks:
ARP poisoning
ICMP redirect
Port stealing
DHCP spoofing
For our first test we will select ARP Poisoning
. Once we click on it, a pop-up window appears and we can select some options for the attack. For now let us enable the Sniff remote connections
option and click OK.
The ARP poisoning attack automatically starts and we should now be able to intercept the traffic of our target machine.
Now that we know that the attack is working, let us click on View->Connections
in order to inspect the traffic intercepted. As we can see, here is all the traffic generated from the target machine.
In order to inspect the packets, we can double click on a connection listed in the previous view. A new tab appears, showing the details and the data transmitted.
Ettercap will also automatically tries to intercept credentials sent via the network. Indeed we can see it was able to automatically gather the username and the password sent by the target host to the FTP server.
It is important to know that with the current configuration we can use other sniffing tools at the same time. For example, we can start Wireshark to sniff the tap0
traffic.
You need to also know that some traffics are encrypted (i.e. SSL), but we can configure Ettercap later on in order to intercept and decrypt this traffic, but also what pitfalls and limits we may face.
4.6.2. Cain & Abel: Sniffing and MitM Attacks
Another very powerful and infamous tool that we can use to mount MitM attacks is Cain & Abel.
To demonstrate how Cain works, we will use the same target used with Ettercap.
Steps (Image available):
The first thing to do once Cain starts, is to
Configure
button in the top menu Ensure that you select the correct network adapter, and that you are sniffing in promiscuous mode. Also notice that some older wireless cards may not be able to sniff in promiscuous modeOnce we are sure we have selected the correct interface to use, we have to select the
Sniffer
tab and start the sniffer by clicking on theStart/Stop Sniffer
iconNow that we are in the correct window, let us right-click in the white space and select
Scan MAC address
. We need to provide the address range to scan and Cain will automatically resolve IP to MAC based on ARP Request/Reply packets.
To intercept the data between these devices, we must now perform the ARP poisoning attack.
One of the other powerful uses for Cain, is the interception of NTLM (NT LAN Manager) challenge spoofing. If a network utilizes Active Directory for authentication, Cain will be able to get the NTLM SHA1 hashed credentials from the network by spoofing the NTLM challenge response mechanism.
Moreover, any encrypted passwords can be sent to the Cain built-in Cracker, by right clicking on the line that contains the password that you need to decrypt and then clicking send to cracker
4.6.3. Macof
As we already know, switches keep a translation table, known as the Content Addressable Memory (CAM) table. This table maps MAC addresses to the physical ports on the switch.
In other words, the CAM table allows a switch to intelligently route packets from one host to another, but it has a limited memory for this function.
This is how CAM table looks like: |PORT| MAC | TTL | |----|-----|-----| | 1 |MAC_A|1600 | | 1 |MAC_B| 90 | | 1 |MAC_C|1000 | | 2 |MAC_D| 36 |
MAC flooding makes use of this limitation of memory of the CAM table. It will flood the switch with fake MAC addresses, until the switch cannot keep up. This causes the switch to enter into what known as a failopen mode, wherein the switch begins acting as a network Hub by broadcasting packets to all the machines on the network.
MAC flooding can be performed with both Ettercap and Cain, but we will see how to run the attack with Macof, a utility which comes with dsniff suite.
Macof can generate 155,000 MAC entries per minute, and generally takes less than 70 seconds to fill the CAM table on an average switch.
Macof is a C version of the Perl module Net::RawIP macof program, originally written by Ian Vitek.
Like many other tools, best results will come from running the tools as an administrator or root level user, or a user that has the same privileges on the system.
Basic Macof usage:
Description:
-i
interface: Specify the interface to send on-s
src: Specify source IP address-d
dst: Specify destination IP address-e
tha: Specify target hardware address-x
sport: Specify TCP source port-y
dport: Specify TCP destination port-n
times: Specify the number of packets to send
Please note that using macof may cause degradation of network services, so be aware when running it in your network.
Also ensure that port forwarding is active on the attacking machine as describes earlier in the module. To do so, you can run the following command:
For example: Let us run the command and set the interface tap0
with the -i
option: root@els: $ sudo macof -i tap0
Since the previous command will keep sending traffic, we can specify the amount of packets to send. For example, let us set them to 32 with the -n
option, Once the 32 packets have been sent, Macof will automatically stop.
4.6.4. Arpspoof
Now we will take a look at ARPspoof, which executes the MitM attack that will allow us to sniff traffic.
This tool is part of dsniff package. It will constantly send ARP answers to our targets in order to poison its ARP table.
We will use the following test environment, same of the previous tests (see image):
Steps:
Before running the tool, let us take a look at our victim machine and pull up the current ARP table on the system. To do this, we run the
arp -a
command from the prompt (see image).
In the output we can see that the victim IP address is 172.16.5.15, and that the router (172.16.5.1) MAC address is 00:50:56:B1:31:04.
Moreover the attacker (172.16.5.152) has the following MAC address: EA:75:03:7F:07:EB 2. Now that we know these information, we can go into our attacker machine and run the arpspoof that will start the attack by running sudo arpspoof -i tap0 -t 172.16.5.15 172.16.5.1
: stduser@els:~$ sudo arpspoof -i tap0 -t 172.16.5.15 172.16.5.1 ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb ea:75:3:7f:7:eb 0:50:56:b1:31:4 0806 42: arp reply 172.16.5.1 is-at ea:75:3:7f:7:eb
With this command we are sending ARP replies to the victim host (-t 172.16.5.15
), telling that the MAC address of the host 172.16.5.1 (gateway) is our MAC address.
To complete the attack we have to run a new arpspoof command, similar to the previous one, but with the 2 IP addresses in the reverse order. This allows us to change the ARP table on the gateway too and be able to intercept the full communications between the victim and the gateway:
Once we run the previous command, the MitM attack is complete and we will be able to intercept the victim traffic with external tool such as Wireshark or tcpdump
Important: Before running the arpspoof commands, be sure you have enabled IP forwarding on your attacker machine, so that the traffic goes through your host.
You can do this with the following command: sudo echo 1 > /proc/sys/net/ipv4/ip_forward
4.6.5. Bettercap
Bettercap is an open-source, modular, multi-platform, and offers a great amount of options and features that will allow us to highly configure our MitM attacks.
Once again we will use the same testing environment used so far and the same target machines. Like the tools we've seen so far, Bettercap implements an ARP spoofer feature that allows us to target both the whole network or a single known address.
-h
-G
--gateway ADDRESS Manually specify the gateway address-I
--interface IFACE Network interface name-S
--spoofer NAME Spoofer module to use-T
--target ADDRESS1.address2 Target IP address --ignore ADDRESS1.address2 Ignore addresses if found-O
--log LOG_FILE Log all messages into a file-D
--debug Enable debug logging-L
--local Parse packets from/to the address of this PC-X
--sniffer Enable sniffer-P
--parser Enable parserAnd others
Steps:
First, we need to find our targets in the network. To do so we can simply run Bettercap on a specific interface with the
--no-spoofing
option:
As we can see, only the discovery mode is enabled and the output shows that Bettercap is able to automatically identify the gateway (172.16.5.1), the other hosts in the network and their MAC addresses.
Notice that by default it also attempts to perform a NBNS hostname resolution for each host, but we can disable this feature by adding the --no-target-nbns
option to our command.
Now that we know the alive hosts in our network, let us start configuring Bettercap. Notice that if we run it without any options, Bettercap by default will run a spoofing attack against all the host in the network.
Since we want to run the ARP spoofing attack on a specific target (172.16.5.15), we will use the
-T
option
It is important to know that if Bettercap does not identify the correct gateway or not. If we want to manually specify a different gateway address, we can use the -G
option followed by the IP address of the gateway.
In our case, our command will look like the following: bettercap -I tap0 -G 172.16.5.1 -T 172.16.5.15
Before running the previous command let us also enable the sniffer feature with the -X
option. As stated in the documentation, the credentials sniffer is able to dissect and print information such as: URLs visited, HTTP POST data, HTTP authentications, FTP credentials, and many more.
We can decide what information to analyze but we can also use regex to capture the sniffed data.
For now we will only enable the following: HTTPAUTH, FTP, URL, POST.
Our final command will look like the following: bettercap -I tap0 -T 172.16.5.15 -X -P "HTTPAUTH,URL,FTP,POST"
Once we run the command, Bettercap starts collecting URLs and data sent via POST/GET parameters.
Last updated