Jun 29, 2013 06:41 PM
(This post was last modified: Jun 29, 2013 06:43 PM by Root1337.)
I did this in a rush, didn't realize time was ticking on me. Might be some minor grammar errors or confusing sentencing, but I'll be on later to clarify any questions.
I apologize if the pictures are too large, I wasn't sure if I should put in img tags or keep just the links, please pm me if you think this thread is too long / large due to the pictures.
1) Download Cain & Abel v4.9.46 for Windows NT/2000/XP here.
2) Run Cain & Abel with Administrator privileges and you should see the following.
![[Image: a37ccc0d6f5ed1282c8af265841a9686.png]](https://gyazo.com/a37ccc0d6f5ed1282c8af265841a9686.png)
3) Click on the second button on the action bar, below "File" and above "Decoders." (Denoted in picture by red box).
![[Image: 4912627d69066b54b183cd4aeeb38b8d.png]](https://gyazo.com/4912627d69066b54b183cd4aeeb38b8d.png)
4) Click on the Sniffer tab to the right of Network and to the left of Cracker.
![[Image: 9c982be0e6e8854c5e1f01af22a363ac.png]](https://gyazo.com/9c982be0e6e8854c5e1f01af22a363ac.png)
5) Click on the white box and then click on the blue + sign on the top, above the Sniffer tab. Press OK on the next dialog.
![[Image: 9527ccd374f739903554e9e8b395984f.png]](https://gyazo.com/9527ccd374f739903554e9e8b395984f.png)
6) IMPORTANT! Remember the IP address for the OUI fingerprint named "MICROSOFT," mine is 192.168.1.28.
![[Image: 44035df4e4859a0969a4c0ebf38f9f7a.png]](https://gyazo.com/44035df4e4859a0969a4c0ebf38f9f7a.png)
7) Click the APR button on the bottom of the program, to the right of Hosts and to the left of Routing.
![[Image: f1fdee7b3755658e3e069101c25d7938.png]](https://gyazo.com/f1fdee7b3755658e3e069101c25d7938.png)
8) Click anywhere in the top white box.
![[Image: 9f32522936d28b04af7a0b29bfda5c61.png]](https://gyazo.com/9f32522936d28b04af7a0b29bfda5c61.png)
9) Click the Blue + sign again.
![[Image: 1cd03115fc2921f63dbb246ba63df842.png]](https://gyazo.com/1cd03115fc2921f63dbb246ba63df842.png)
10) IMPORTANT! Click 192.168.1.1 on the left box, and then the right box should populate. Now, in the right box, click the ip you acquired from the OUI fingerprint of Microsoft from step 6.
![[Image: a3cf7948abdd5cf81f7087e55a41b8fd.png]](https://gyazo.com/a3cf7948abdd5cf81f7087e55a41b8fd.png)
This is what you should see after step 10.
![[Image: 7c9411a168ed6caef099a5199bf3b59b.png]](https://gyazo.com/7c9411a168ed6caef099a5199bf3b59b.png)
11) Now, on the top left of your screen, click the yellow radioactive symbol. This will start the APR process.
![[Image: 21a7d7b7cf95b92806c63c8e91a35a0f.png]](https://gyazo.com/21a7d7b7cf95b92806c63c8e91a35a0f.png)
The bottom box should now populate with incoming and outgoing packets. The one that you're interested in while playing a game is 99.9% of the time the one that is adding incoming and outgoing packets very rapidly.
Use this at your own risk, I'm not responsible for what you do with this, as I just thought this was interesting as I was messing around with the APR, thought this was interesting.
This is truly a powerful tool, and I just used Xbox Live as an example that many people can relate to in order to understand the concept more easily. Remember that unless you're playing a one-on-one type game such as Madden or FIFA, it'll be hard / impossible to decipher which IP belongs to which player. (As far as I know, haven't messed around with this tool for that purpose yet).
ARP Poison Routing: ARP spoofing also known as ARP poisoning or ARP attack is a technique in which a host in a LAN can "poison" the ARP table of another host causing it to send packets to the wrong destination. The attacker can modify the traffic in the network such a way that it will redirect all traffic to go through it. ARP Spoofing will allow an attacker to sniff data frames.
Source of this definition.
PM me with any questions and if you get lost, I'll be glad to help you with Teamviewer.
I apologize if the pictures are too large, I wasn't sure if I should put in img tags or keep just the links, please pm me if you think this thread is too long / large due to the pictures.
1) Download Cain & Abel v4.9.46 for Windows NT/2000/XP here.
2) Run Cain & Abel with Administrator privileges and you should see the following.
3) Click on the second button on the action bar, below "File" and above "Decoders." (Denoted in picture by red box).
4) Click on the Sniffer tab to the right of Network and to the left of Cracker.
5) Click on the white box and then click on the blue + sign on the top, above the Sniffer tab. Press OK on the next dialog.
6) IMPORTANT! Remember the IP address for the OUI fingerprint named "MICROSOFT," mine is 192.168.1.28.
7) Click the APR button on the bottom of the program, to the right of Hosts and to the left of Routing.
8) Click anywhere in the top white box.
9) Click the Blue + sign again.
10) IMPORTANT! Click 192.168.1.1 on the left box, and then the right box should populate. Now, in the right box, click the ip you acquired from the OUI fingerprint of Microsoft from step 6.
This is what you should see after step 10.
11) Now, on the top left of your screen, click the yellow radioactive symbol. This will start the APR process.
The bottom box should now populate with incoming and outgoing packets. The one that you're interested in while playing a game is 99.9% of the time the one that is adding incoming and outgoing packets very rapidly.
Use this at your own risk, I'm not responsible for what you do with this, as I just thought this was interesting as I was messing around with the APR, thought this was interesting.
This is truly a powerful tool, and I just used Xbox Live as an example that many people can relate to in order to understand the concept more easily. Remember that unless you're playing a one-on-one type game such as Madden or FIFA, it'll be hard / impossible to decipher which IP belongs to which player. (As far as I know, haven't messed around with this tool for that purpose yet).
ARP Poison Routing: ARP spoofing also known as ARP poisoning or ARP attack is a technique in which a host in a LAN can "poison" the ARP table of another host causing it to send packets to the wrong destination. The attacker can modify the traffic in the network such a way that it will redirect all traffic to go through it. ARP Spoofing will allow an attacker to sniff data frames.
Source of this definition.
PM me with any questions and if you get lost, I'll be glad to help you with Teamviewer.
![[Image: dycmiHp.png]](https://i.imgur.com/dycmiHp.png)
![[Image: C1ExMBO.gif]](https://i.imgur.com/C1ExMBO.gif)
