+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Simple Man in the middle attack on windows. (/showthread.php?tid=5501385)
Pages: Pages
1
2
Simple Man in the middle attack on windows. - Mr. Robot - Dec 22, 2016
So very simple and basic MiTM attack on windows.
Download
www.winpcap.org/install/
Download
http://nighthawk.software.informer.com/download/?ca8e7c2
(you can compile it yourself from the github)
Download
https://sourceforge.net/projects/etherwatch/
NightHawk - simple man in the middle with arpspoof for windows, similar to cain and abel but easier to use and navigate. Shows http logins. Doesn't re-arp itself from what I can see which can cause internet to stop after 10 minutes or so.
Winpcap - is the driver/file you need to allow your card to do this kind of activity.
Etherwatch - for monitoring images traveling through your network.
After installing winpcap drivers, we can go ahead and open up nighthawk and choose the adapter connected to the internet at the top and choose advanced mode.
![[Image: 3w0QNeg.png]](https://i.imgur.com/3w0QNeg.png)
Then we want to hit Scan Network to find the IPs of machines on your LAN.
![[Image: dlBqxYC.png]](https://i.imgur.com/dlBqxYC.png)
Once we have decided which computer/phone/device we want to intercept, we click the ipv4 address of it in the "Target 1 box" and in the "Target 2 box" we want to choose your router/gateway IP. To find this we can open up CMD and type in ipconfig -
![[Image: FfdxfDp.png]](https://i.imgur.com/FfdxfDp.png)
Once we have chosen the gateway and the target, we can hit "Start Sniffer" and "Start ARP spoofing"
Next we can click on the "Sniffer" tab at the top and wait for any http login forms.
On the device you are intercepting, you can go to http://aavtrain.com/ and type in a username and password, and it will show up in the sniffer tab on your PC.
![[Image: qKytEiK.png]](https://i.imgur.com/qKytEiK.png)
- One issue with etherwatch is loading sites such as imgur.com with https will crash it.
If that is all working and you are now MiTM you can open up etherwatch - Install it and run it.
Once open, choose your network card and it will start monitoring everything that happens through your adapter - which will mean the MiTM you have running will collect the images too.
With etherwatch you can move images around and WARNING: Potential SPAM or INFECTED LINK the IP or to only monitor images from that IP.
![[Image: eFz2iF5.png]](https://i.imgur.com/eFz2iF5.png)
![[Image: Y9pNlGa.png]](https://i.imgur.com/Y9pNlGa.png)
* - ze-slade - Dec 22, 2016
Looks like a pretty good tutorial, It's tempting to try this out. I never got into mitm attacks, but I always wanted to try one.
* - Mr. Robot - Dec 22, 2016
(Dec 22, 2016 01:23 PM)ze-slade Wrote: Looks like a pretty good tutorial, It's tempting to try this out. I never got into mitm attacks, but I always wanted to try one.
This is a very basic one and wasn't going to put it up as the same can be accomplished with say cain and abel.
The main purpose it to show it can be done, while not as stable as running one on linux - it can be achieved and I will be hopefully working with other users in 2017 to make a completed tool that works 10x faster and better.
These tools are quite outdated and were never really complete so that's unfortunate as I think MiTM attacks are one of the best tools for network infiltration and monitoring.
* - Megabear - Dec 22, 2016
Woah.
This is dope Robot.
=)
I am gonna try this out soon on my windows.
Thanks for helping the community out. :)
* - ze-slade - Dec 22, 2016
(Dec 22, 2016 01:25 PM)Mr. Robot Wrote: This is a very basic one and wasn't going to put it up as the same can be accomplished with say cain and abel.Interesting, that's great to hear you'll be working on a better tool, are you planning on selling it or making it free?
The main purpose it to show it can be done, while not as stable as running one on linux - it can be achieved and I will be hopefully working with other users in 2017 to make a completed tool that works 10x faster and better.
These tools are quite outdated and were never really complete so that's unfortunate as I think MiTM attacks are one of the best tools for network infiltration and monitoring.
* - fannas1 - Dec 22, 2016
Posting to come back and try this tutorial out. Thank you OP very interested in this.
* - ZuGgY - Dec 22, 2016
Thanks for this wonderful tutorial as always!
* - Mr. Robot - Dec 22, 2016
(Dec 22, 2016 01:27 PM)ze-slade Wrote: Interesting, that's great to hear you'll be working on a better tool, are you planning on selling it or making it free?
I had plans on selling it for reasonably cheap maybe $5-$20 for a fully working one with modules for code injection and fun scripts similar to what zANTI runs (replacing downloads,flipping images,replacing images)
* - ze-slade - Dec 22, 2016
(Dec 22, 2016 01:30 PM)Mr. Robot Wrote: I had plans on selling it for reasonably cheap maybe $5-$20 for a fully working one with modules for code injection and fun scripts similar to what zANTI runs (replacing downloads,flipping images,replacing images)
Makes sense, good luck with your project and any future ones to come!
* - Mr. Robot - Dec 22, 2016
Would appreciate for people to try this out and post back results.
* - DatNigguh - Dec 22, 2016
I plan on it in a week or so buddy, thanks for the tutorial and I'd be interested in purchasing a solid tool from ya!
RE: *asd - Mr. Robot - Jun 8, 2018
(Dec 22, 2016 08:20 PM)DatNigguh Wrote: I plan on it in a week or so buddy, thanks for the tutorial and I'd be interested in purchasing a solid tool from ya!
Not a problem, still working on this tool years later. No help and no clue as to what I am doing. Learning as I go.
RE: Simple Man in the middle attack on windows. - Aries Devil - Jun 10, 2018
nice tut man...keep it up
RE: Simple Man in the middle attack on windows. - actuall55 - Jun 22, 2018
Nice Tutorial it seems very useful for monitoring other people who shouldn't be on my network
RE: Simple Man in the middle attack on windows. - Bossbitch24 - Jun 22, 2018
Looking for a legit spammer that have bank logs