Lecturer: Now, in this lecture, 2 2
I wanna show you how to run an ARP spoofing attack 3 3
using Bettercap. 4 4
This will allow us to place our computer 5 5
in the middle of the connection and intercept data. 6 6
Not only that, but we're also gonna see 7 7
how we can read this data. 8 8
So we can see all the URLs 9 9
and all the websites that the target visits 10 10
and we'll see everything that they post. 11 11
So anything any usernames, any passwords 12 12
they send to any websites, 13 13
we're gonna be able to capture them and see them. 14 14
So, first we need to become the man in the middle. 15 15
And we're gonna do this using a module called ARP spoof. 16 16
So if I scroll up to the help menu, 17 17
you can see we have a module here called ARP spoof. 18 18
So as usual, if we don't know how to use this module, 19 19
we're gonna do help arp.spoof, 20 20
because we want to see how to use this module 21 21
and see all the options that we can set for it. 22 22
So as you can see, as usual, 23 23
we can do arp.spoof on to turn this module on. 24 24
We can do arp.ban on 25 25
and this will literally just cut the connection 26 26
of the target. 27 27
This is very simple. 28 28
You can try it on your own time. 29 29
I'm not gonna do it here. 30 30
You can do arp.spoof off to turn it off 31 31
and arp.ban off to turn the ban off. 32 32
Now, in the previous lecture I also said 33 33
anything you see under the parameters 34 34
are the options that we can set for this specific module. 35 35
But I didn't show you how to modify that. 36 36
So in this lecture, 37 37
we're actually gonna be modifying some of these options. 38 38
Now as you can see, the tool is actually very helpful 39 39
because first of all it's given us the option name 40 40
in yellow here. 41 41
So these are the options that we can set, 42 42
that we can change. 43 43
And then it's also telling us 44 44
a description of what this option does 45 45
and the default value. 46 46
So for example, we can see we have an option 47 47
called arp.spoof.fullduplex. 48 48
You can see the description for this option 49 49
and basically what this option will do 50 50
if you set it to true, 51 51
it will spoof both the router and the target. 52 52
So it's similar to what we did with ARP spoof 53 53
when we executed the command twice 54 54
to spoof both the router and the target. 55 55
So if you set this to true, 56 56
both the router and the target will be spoofed 57 57
and you will be in the middle of the connection. 58 58
If you leave it to the default, which is false, 59 59
you will only spoof the target machine. 60 60
Now this can be useful 61 61
if the router has some sort of protection 62 62
against ARP spoofing attacks 63 63
because you won't to be interacting with router at all. 64 64
But it's also limiting because we won't be able to do 65 65
what I'm gonna do in the next lectures 66 66
because the router will communicate 67 67
with the target device directly. 68 68
So we won't to be able to inject stuff 69 69
in the responses that the router sends to the target device. 70 70
Now, I actually wanna change this to true 71 71
and the method I'm gonna do this 72 72
can be used to change any option 73 73
in any module in Bettercapp. 74 74
So not only in the arp.spoof. 75 75
If you're using any module, 76 76
you can do help followed by the module name 77 77
to get help about that module name. 78 78
You can see all of the options that you can set in here. 79 79
And then if you want to modify the value 80 80
of any of these options, all we have to do 81 81
is copy the option name, which is what I have right here 82 82
and type set, followed by the option 83 83
that you want to modify. 84 84
And in my case it's called arp.spoof.fullduplex. 85 85
And I wanna set this to true. 86 86
So very, very simple. 87 87
And like I said, you can use this command 88 88
to change any option in any module in Bettercap. 89 89
All you have to do is type, set, 90 90
followed by the option name, 91 91
followed by the value that you want to set. 92 92
So I'm gonna hit enter and that's done. 93 93
If you don't see errors, 94 94
that means it got executed properly. 95 95
The next option that I wanna change is the targets. 96 96
So again, in the description, 97 97
it's telling us that these are the targets 98 98
that I want to run the attack against 99 99
and I can use a coma if I wanted to target more than one IP 100 100
at the same time. 101 101
So again, just like what I did before, 102 102
I'm gonna do set, followed by the option name, 103 103
which is arp.spoof.targets. 104 104
And you can actually use the tab to auto-complete. 105 105
So if I just type T-A tab, 106 106
it'll auto complete the targets for me. 107 107
And after this I'm gonna put the value 108 108
that I want to set this option to, 109 109
which is the IP of my target 110 110
and we can get this using net discover, using zen map 111 111
or using the result that I got in here. 112 112
After I ran the recon module, I did net.show 113 113
and we got all of this, 114 114
which is the list of all of the computers 115 115
connected to the same network. 116 116
And my target right now, is this particular device, 117 117
the 10.0.2.7. 118 118
This is my windows virtual machine right here. 119 119
So I'm gonna put the IP 10.0.2.7. 120 120
And again, we don't see any errors, 121 121
which means that everything got executed as expected. 122 122
Now, we're ready to run the tool. 123 123
And again, based on the help menu that we got, 124 124
we can do arp.spoof on to turn this module on. 125 125
So we're gonna do arp.spoof on. 126 126
And perfect, as you can see, we see no errors. 127 127
It's telling us that the module is running. 128 128
And if I do help, again, we're gonna get a list 129 129
of all of the modules that are running right now. 130 130
And as you can see, we can see that ARP spoofing is on. 131 131
Also, it is very important that you make sure 132 132
that the net.probe and the net.recon are running. 133 133
We did this in the previous lecture. 134 134
That's why I didn't do it now. 135 135
So right now, Bettercap should be doing 136 136
what ARP spoofing was doing, 137 137
fooling both the router and the target device 138 138
and putting me in the middle of the connection 139 139
as shown here. 140 140
So, let's go to the windows machine right here. 141 141
And I'm gonna do arp-a and as you can see, 142 142
the routers MAC address right here 143 143
is the same as the MAC address for this device, 144 144
which is the 10.0.2.15. 145 145
And if I go back here to the Kali machine 146 146
and do ifconfig, you'll see this is the same MAC address 147 147
as the MAC address of the Kali ETH0 interface. 148 148
So basically, what this means is this windows machine, 149 149
every time it wants to send something to the router, 150 150
it'll send it to the Kali machine. 151 151
And because we set the full duplex option on, in Bettercap, 152 152
the router also thinks that this Kali machine 153 153
is the target machine. 154 154
Therefore, anytime it needs to send a response 155 155
to the windows machine, 156 156
it'll actually send it to Bettercap right here. 157 157
And like I said before, this means every username, password, 158 158
URL, anything the target computer sends or receives 159 159
will have to go through the Kali machine 160 160
where we're gonna be able to read it, modify it, or drop it. 161 161
And I'm gonna walk you through that in the next lectures.