[Lecturer] Now, in this lecture and the next few lectures 2 2
I wanna start talking about Man In the Middle Attacks. 3 3
These are attacks that we can launch 4 4
only if we are able to intercept 5 5
the communication between two devices. 6 6
Hence the name, Man In The Middle Attacks. 7 7
So a normal communication would look like this, 8 8
where the device is directly communicating with the entity 9 9
that they want to communicate with. 10 10
In a Man In The Middle Attack, 11 11
the hacker would be able to place themselves 12 12
in the middle of the connection, 13 13
allowing them to intercept and see anything 14 14
that is being transferred between the two devices. 15 15
Now, there are a number of ways to achieve this. 16 16
The first method that we'll cover in this course 17 17
is using an ARP spoofing attack. 18 18
ARP spoofing allow us to redirect the flow of packets 19 19
so instead of it flowing as shown in this diagram, 20 20
it would flow through my own computer. 21 21
So any requests sent and any responses received 22 22
by the target computer, 23 23
will have to flow through the hacker computer. 24 24
This means that any messages, any websites, any images, 25 25
any usernames, any passwords entered by the target 26 26
will have to flow through my computer. 27 27
This allows me to read this information, 28 28
modify it or drop it. 29 29
So as you can see, 30 30
this is a very serious and very powerful attack. 31 31
And the reason why it is possible 32 32
is because ARP is not very secure. 33 33
Now for us to understand how this works, 34 34
you need to have a basic understanding of what ARP is. 35 35
ARP stands for Address Resolution Protocol, 36 36
and it's a very simple protocol 37 37
that allow us to link IP addresses to MAC addresses. 38 38
So for example, let's say we have a network here, 39 39
we have devices A, B, C, and D. 40 40
They're all connected to the same network. 41 41
And we have the router here for this network. 42 42
We can see that each device has an IP and a MAC address. 43 43
Let's assume that device A 44 44
needs to communicate with device C. 45 45
Now we're also gonna assume 46 46
that device A knows the IP of device C. 47 47
But as we know so far, 48 48
in order for these devices to communicate 49 49
within the same network, 50 50
device A needs to know the MAC address of device C. 51 51
Because like we said before, 52 52
the communication inside the network 53 53
is carried out using the MAC address 54 54
and not using the IP address. 55 55
So this is a perfectly normal situation where have a client 56 56
that needs to know the MAC address of another client 57 57
so that it can communicate with this client. 58 58
So what this client does, it uses the ARP protocol. 59 59
What do I mean by that? 60 60
Basically, it sends a broadcast message. 61 61
So it sends an ARP request to all the clients on the network 62 62
saying who has 10.0.2.6? 63 63
Now all of these devices will ignore this packet 64 64
except the one that has this IP address, 65 65
which is 10.0.2.6, which is device C. 66 66
So all devices will not do anything 67 67
and the only device that will respond is device C 68 68
sending an ARP response. 69 69
In this response, device C is gonna say I have 10.0.2.6, 70 70
my MAC address is this MAC address. 71 71
This way device A will have the MAC address of device C 72 72
and now it will be able to communicate with device C 73 73
and do whatever task that it wanted to do initially. 74 74
So all of this communication 75 75
is facilitated using the ARP protocol. 76 76
Like I said, the ARP protocol 77 77
is a very simple protocol as you can see. 78 78
All it has is requests and responses 79 79
and the whole point of it 80 80
is so that we can link IP addresses to MAC addresses 81 81
or translate IP addresses to MAC addresses. 82 82
So a device can send a request asking for a MAC address 83 83
and then the device that has the MAC address 84 84
would respond with its MAC address. 85 85
So each computer have an ARP table, 86 86
which links IP addresses on the same network 87 87
to their MAC addresses. 88 88
So if I go on the kali machine and do ARP-a, 89 89
you can see my ARP table here and as you can see 90 90
it's linking the router's IP to the router's MAC address. 91 91
Now same if I go to the windows machine 92 92
and run my CMD and do ARP-a, you'll see again, 93 93
it's linking the router's IP to its MAC address. 94 94
So this machine, 95 95
anytime it needs to send any request to the Internet, 96 96
it will direct that request to this MAC address, 97 97
to the MAC address that's associated 98 98
with the IP of the router, which is 10.0.2.1. 99 99
Now this value in here, can be easily modified 100 100
by exploiting the ARP protocol. 101 101
So let me go back to my diagrams 102 102
and right here we have a diagram of a typical network 103 103
and you can see that normally 104 104
any device that's connected to the network, 105 105
if it wants to send a request, 106 106
it will send them to the router, the router will go 107 107
and send that request to the Internet, wait for the response 108 108
and then forward the response 109 109
to the device that requested it. 110 110
So if the hacker or the victim 111 111
or any other computer on the network 112 112
wanted to send a request, 113 113
they will send that request directly to the router. 114 114
Now what we can do is we can exploit the ARP protocol 115 115
and send two ARP responses, 116 116
one to the gateway and one to the victim. 117 117
We're gonna tell the gateway 118 118
that I am at the IP of the victim, 119 119
so the access point will update its ARP table 120 120
and it'll associate the IP of the target 121 121
with my MAC address. 122 122
We'll do the same with the victim, 123 123
so we'll send it an ARP response. 124 124
We're gonna tell it that I am at 10.0.2.1 125 125
so it's going to update its ARP table 126 126
and associate the IP of 10.0.2.1 with my own MAC address. 127 127
So the result of this, the victim is gonna think 128 128
that I am the router and the router is gonna think 129 129
that I am the victim. 130 130
So anytime the victim wants to send any requests, 131 131
the requests will have to flow through my computer 132 132
and I'm gonna forward them to the router. 133 133
And then anytime the access point or the router 134 134
wants to send responses, they're gonna go to my machine 135 135
because it thinks that I am the victim 136 136
and then I'm going to forward it to the victim. 137 137
So as you can see, 138 138
this puts me in the middle of the connection 139 139
and it gives me so much power 140 140
and we'll see all the things that we can do 141 141
once we become the Man In The Middle. 142 142
Now the main reason why we can do all of this 143 143
is because ARP is not secure. 144 144
Because first of all, clients can accept responses 145 145
even if they did not send a request. 146 146
So as I said before, 147 147
we're gonna send a response to the access point 148 148
and a response to the victim 149 149
telling them that I am at a specific IP 150 150
without them asking who am I 151 151
or without them asking for this IP. 152 152
I'm just gonna send the response 153 153
and they're gonna accept that response anyway. 154 154
Not only that, 155 155
well, they're also not going to verify who I am. 156 156
So when I say that I am a 10.0.2.7 157 157
I am clearly not at that IP 158 158
because this computer is at this IP. 159 159
But the access point will trust this 160 160
and it'll actually update its ARP table 161 161
based on the information that I sent. 162 162
Same goes to the victim. 163 163
I'm gonna tell it that I am at 10.0.2.1 164 164
it's gonna trust and believe this, 165 165
even though I am clearly not at this IP 166 166
because the access point is at this IP. 167 167
So these are the two main weaknesses with ARP protocol 168 168
that allow us to run ARP spoofing attacks.