+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Tutorial] See what images your network is viewing - Windows (/showthread.php?tid=5353419)
[Tutorial] See what images your network is viewing - Windows - Mr. Robot - Jul 27, 2016
So there might be a better way of doing this on windows but while I work on my project, this is the best you will get out of me.
You will need
Cain and abel http://www.oxid.it/cain.html
Wireshark https://www.wireshark.org/download.html
Please note the first part of this tutorial is taken from the following site to save me from editing pictures and uploading, all credit goes to the author.
https://neelpathak.wordpress.com/2013/05/08/sniffing-passwords-from-lan-network-using-cain-and-abel-tool/
To start what you need to do is open Cain and abel
![[Image: 1.png?w=540&h=309]](https://neelpathak.files.wordpress.com/2013/05/1.png?w=540&h=309)
Goto -> Sniffer Tab and click Configure in the main menu to configure your packet listening adapter.
![[Image: 2.png?w=540&h=307]](https://neelpathak.files.wordpress.com/2013/05/2.png?w=540&h=307)
Select the appropriate network adapter for your network that you want to sniff the packets for plain-text passwords. And Click Ok.
![[Image: 3.png?w=540&h=310]](https://neelpathak.files.wordpress.com/2013/05/3.png?w=540&h=310)
Click the Green Adapter icon as shown below. This means that you just configured the adapter and now you are turning it ON.
![[Image: 4.png?w=540&h=306]](https://neelpathak.files.wordpress.com/2013/05/4.png?w=540&h=306)
Now select the APR tab below as shown and now first click on the right side upper pane area. When you click that area the blue plus (“+”) icon will get enabled. Press that blue plus (“+”) icon.
![[Image: 5.png?w=540&h=307]](https://neelpathak.files.wordpress.com/2013/05/5.png?w=540&h=307)
This is very interesting step. Now we need to select the router`s IP address and click ok. This means that we want to listen to every packet that is sent to router. If we select any other IP address in our LAN network then we can listen to only that particular HOST on the network. Since the router responds to all the request of HOSTS connected in a LAN. Thus we can listen to all the HOSTs.
![[Image: 6.png?w=540&h=307]](https://neelpathak.files.wordpress.com/2013/05/6.png?w=540&h=307)
Now click the Yellow Circle icon as shown. This means that we are starting ARP poisoning.
![[Image: 7.png?w=540&h=307]](https://neelpathak.files.wordpress.com/2013/05/7.png?w=540&h=307)
We can see that in the upper right panel there is an IP address of our router and when we press that Yellow Circle icon (button), it performs ARP poisoning.
Now click the password tab which is at the bottom. We can see that we are getting passwords of HTTP i.e. plain text session in our LAN network.
![[Image: 8.png?w=540&h=307]](https://neelpathak.files.wordpress.com/2013/05/8.png?w=540&h=307)
Note: While performing this practical you will notice that there is significant reduction in he network speed. This is due to the fact that ARP spoofing on the LAN network creates many fake packets advertising other`s host identity.
==============================================
Now open Wireshark.
Press the circle button at the top, "Capture options" Then choose your network card that is running on cain and abel, then hit start.
![[Image: OjJVgaF.jpg]](https://i.imgur.com/OjJVgaF.jpg)
Let that run for a while, and when you are done, hit file - then hit export objects, http...
![[Image: 02AnEbu.jpg]](https://i.imgur.com/02AnEbu.jpg)
Then hit save all and choose a place to save the images.
Now you can open that folder and view all the images your network has been viewing.
If you are unable to choose "Export objects" you may need to hit file, save as first then choose export objects.
* - thales - Jul 27, 2016
Hmm interesting. I never even knew this was possible. Nice tut.
* - Mr. Robot - Jul 27, 2016
(Jul 27, 2016 09:03 PM)thales Wrote: Hmm interesting. I never even knew this was possible. Nice tut.
Thanks man, definitely something worth looking into. Using wireshark to and cain and abel to intercept packets on a windows machine opens opportunities in the market right now.
* - M3LT - Jul 28, 2016
Pretty sick tutorial, been looking for an ARP poisoning tutorial for a while :) nice guide man
* - Pharah - Jul 28, 2016
Nice One, however this will only work when connected to LAN and no WLAN right?rip me
* - Mr. Robot - Jul 28, 2016
(Jul 28, 2016 03:33 AM)Pharah Wrote: Nice One, however this will only work when connected to LAN and no WLAN right?rip me
I have had it working on WLAN but it did have a slower network connection.
It's always easier to use a virtual box or bootable disk running kali or a linux suite that you can use tools like driftnet and urlsnarf.
I will hopefully have something out soon that is easier to manage with windows.
* - Pharah - Jul 28, 2016
(Jul 28, 2016 03:36 AM)Mr. Robot Wrote: I have had it working on WLAN but it did have a slower network connection.
It's always easier to use a virtual box or bootable disk running kali or a linux suite that you can use tools like driftnet and urlsnarf.
I will hopefully have something out soon that is easier to manage with windows.
😠 I tried for 2h to install ISO's on my laptop, it didnt work......
* - Mr. Robot - Jul 28, 2016
(Jul 28, 2016 03:43 AM)Pharah Wrote: 😠 I tried for 2h to install ISO's on my laptop, it didnt work......
Do you have a USB and the kali image? just boot it and run as non persistent
* - Mr. Robot - Aug 9, 2016
Anyone still need this or am I closing it?
* - Mr. Robot - Jun 14, 2017
Trying to do this in a better format. Anyone have ideas?
RE: [Tutorial] See what images your network is viewing - Windows - Mr. Robot - Apr 16, 2018
This is still working great too, nobody sees these anymore.
RE: [Tutorial] See what images your network is viewing - Windows - speed10 - Apr 17, 2018
great working thanks !!!!!!!!!!!!!!!!!
RE: [Tutorial] See what images your network is viewing - Windows - z3r0c00l_ - Apr 17, 2018
You can also do that in Kali Linux using Bettercap and Driftnet.
RE: [Tutorial] See what images your network is viewing - Windows - Mr. Robot - Jun 8, 2018
(Apr 17, 2018 08:22 AM)z3r0c00l_ Wrote: You can also do that in Kali Linux using Bettercap and Driftnet.
You can, but this is specifically for windows.