Man In The Middle - Hacking Illustrated

Man in The Middle DemystifiedKeatron EvansSenior Instructor

Still one of the most dangerous attacks.While most security professionals and administrators understand MiTM conceptually, few can actually execute it and prove to the laymen that it is a valid and real threat. In this presentation I’ll give a step by step complete with screenshots on exactly how it’s done.

How does it happen?Basically an attack on the arp protocol.When computers communicate across a network the initiator sends an arp request that asks who has a particular ip address.

This request is broadcast to everyone on the LAN and depends on the only response coming from the true holder of said IP address.

The protocol has no built-in functionality to tell if the response comes from the true source.

Additionally, there’s no rule in the arp protocol that says one has to wait for a request to send a response!The Setup!We’ll be using two servers.

One server will authenticate to another via ftp.

We’ll use Backtrack and arpspoof them both.

The arpspoof makes each victim 1 believe I’m victim 2 and make victim 2 believe I’m victim 1.

Once we’ve got this in place, I’ll turn on ip forwarding on Backtrack which allows me to route the packets on to the intended recipient, while still allowing me to “see” the packets.

We’ll have dsniff running as well to conveniently grab the credentials from the packets.Communications before attackNormal traffic flowVictim 2IP address 192.168.2.138Victim 1IP address 192.168.2.128Man in The MiddleIP address 192.168.2.135

Communications after attackDesired traffic flowVictim 2IP address 192.168.2.138Victim 1IP address 192.168.2.128Man in The MiddleIP address 192.168.2.135

Step 1Let’s setup Backtrack properly first. There is chance that once you start it, you didn’t get an ip or your ethernet/or wireless interface wasn’t enabled. We’ll need to bring the interface up first. Then we’ll need to have it get an ip address via dhcp. So let’s do those things.

Eth0 interface is down so let’s bring it up;

After the up command we enter ifconfig again and see that eth0 is now up.

Now we need to tell it to get an ip address via a dhcp request. The command is /etc/init.d/networking restart

It gets an ip address from your dhcp server. Verify it with ifconfig again. We see we have an ip of 192.168.2.135.

Now we go to our first victim and see that its’ ip is 192.168.2.128.

Victim 2 has an ip address of 192.168.2.138.

Here’s the Filezilla ftp server running on victim 1.

Let’s verify that the two victims can communiate. I’m issuing a continuos ping from victim 2 (.138) to victim 1 (.128).We’ll let this ping run continously because we’re going to interrupt it with our arpsoof and verify our spoof is working.

Now we go back to our Backtrack and open three terminal shells (you’ll need all three). First arpspoof victim 2 to victim 1. In other words, make victim 1 think you’re victim 2. Now in the second terminal, do the exact opposite. See below.

Once you hit enter on both terminal windows, you’ll see that it’s telling victim 1 that .138 is at the Backtrack mac address, while also telling victim 2 that .128 is at the Backtrack mac address.

We verifty that the spoof is working by seeing if the pings we started earlier on victim 2 are now failing. See below.

We have now successfully diverted both victims traffic to our Backtrack. Now we need to enable ip forwarding so we can now route this traffic to it’s intended destination.

Once we’ve enabled ip forwarding, go back and check your pinging victim 2 and see that the pings are now successful again. Congrats! You’re now man in the middling. But we need to grab credentials. So we’ll need another tool for that.

Man In The Middle - Hacking Illustrated

More Related Content

What's hot

Viewers also liked

Similar to Man In The Middle - Hacking Illustrated

Recently uploaded

Man In The Middle - Hacking Illustrated