Original subtitles

1 1

In the previous lectures, 2

2

we learned how to use Bettercap 3

3

to discover all clients on the same network, 4

4

run an ARP spoofing attack to intercept the data 5

5

and then sniff data to see the usernames, passwords, 6

6

and everything that's getting sent over the network. 7

7

Now in order to do this, 8

8

we actually had to run a number of commands. 9

9

So first of all, we had to do net.probe on, 10

10

to turn on the probe module. 11

11

We had to set the settings for the ARPspoof module, 12

12

turn that on, and then turn the sniffing module on. 13

13

Now, every time you want to do this, 14

14

every time you want to intercept data and see it onscreen, 15

15

you're gonna have to do all of the steps that I showed you 16

16

in the previous lecture. 17

17

Or if you're lazy like myself, 18

18

you can use a caplet to do all of that automatically, 19

19

which is exactly what I wanna show you in this lecture. 20

20

So what do I mean by a caplet? 21

21

Well, basically a caplet is just a text file 22

22

that contains all of the commands that you want to run. 23

23

So I'm gonna resize this menu. 24

24

I'm gonna open a text file 25

25

and I'm just gonna organize this a little bit 26

26

to make it easier to follow 27

27

and I'm gonna clear this window here 28

28

and I'm gonna go to the first command that we had to run 29

29

in order to do this. 30

30

So again scrolling up, the first thing we did 31

31

was net.probe on. 32

32

So in my text file here, 33

33

I'm gonna literally type this command, net.probe on. 34

34

And as we saw, this will automatically start 35

35

the net.recon module. 36

36

Again, we enabled both of these modules 37

37

in order to discover the connected clients 38

38

and keep automatically discovering any new clients 39

39

that connect to the network. 40

40

The next thing that we did 41

41

was modify the settings for the ARPspoof module. 42

42

So we did set ARPspoof full duplex to true. 43

43

I'm gonna actually copy this and paste it here. 44

44

Then we set the target IP. 45

45

So again, I'm just gonna copy this and paste it here 46

46

and keep in mind this is very important. 47

47

You wanna make sure that you change the IP here 48

48

to the IP of your target all the time. 49

49

And if you are targeting multiple computers, 50

50

you can just use the comma 51

51

and type the next IP after the coma. 52

52

Next we turned on the ARPspoof module. 53

53

So again, this is what I'm gonna do here. 54

54

I'm gonna do arp.spoof on. 55

55

And finally we also run the sniffer by doing net.sniff on. 56

56

So again, I'm just gonna type this in here, net.sniff on. 57

57

So this is actually a nice summary 58

58

of what we did in the previous lectures. 59

59

Again, like I said, 60

60

every time you wanna intercept the connections, 61

61

you're gonna have to start Bettercap 62

62

and run all of these commands manually. 63

63

You wanna start the probe module, 64

64

you wanna enable the full duplex. 65

65

So you full or spoof the target and the router. 66

66

You wanna set your target IP 67

67

and you wanna turn on the spoof and turn on the sniff. 68

68

So to make this very easy, 69

69

instead of having to type this every time 70

70

we want to run an ARP spoofing attack and intercept data, 71

71

I put all of this in a text file. 72

72

I'm gonna save this text file. 73

73

I'm gonna put it in my root directory 74

74

and I'm gonna call it spoof.cap. 75

75

So I'm gonna save this now and I can close it 76

76

because we're done with it and we can go back here. 77

77

And what I'm actually gonna do, I'm gonna exit out of this. 78

78

So I'm gonna quit Bettercap and I'm gonna clear the screen. 79

79

And if I do LS to list all of the files and directories 80

80

in the current working directory, 81

81

because right now I am in root. 82

82

So if I do LS, you can see we have a new file 83

83

called spoof.cap. 84

84

And just to confirm, 85

85

if I go down to my file manager right here, 86

86

you can see we have a new file, again in the root 87

87

called spoof.cap. 88

88

And all we want to do, is feed this spoof file 89

89

to Bettercap before we start Bettercap. 90

90

Now, we don't know how to do this, 91

91

so we're gonna do bettercap--help to see all of the options 92

92

that we can set with Bettercap. 93

93

And what we want to do is use the -caplet option right here. 94

94

So we're gonna run Bettercap like we used to do. 95

95

First of all, we do Bettercap followed by iface 96

96

to specify the interface that is connected 97

97

to the target network and in my case this is ETH0. 98

98

So, so far this is identical 99

99

to what I've been doing in the previous lectures. 100

100

The only difference now, 101

101

is we're gonna use the -caplet option 102

102

to specify my caplet file that I just created. 103

103

So I'm gonna do -caplet 104

104

followed by the file that I just created, 105

105

which is called spoof.cap and that's it. 106

106

Now, before I hit enter, just to confirm to you, 107

107

I'm gonna go back to my windows machine 108

108

and I'm gonna do ARP-a to show you. 109

109

And as you can see right now, 110

110

the router's IP right here, has this MAC address. 111

111

So after I run this, 112

112

it should automatically start all of the modules 113

113

that I just typed and it should run an ARP spoofing attack. 114

114

Therefore, the router's MAC address 115

115

should change to the MAC address of ETH0 116

116

that is connected to kali right here. 117

117

So I'm gonna hit enter and as you can see, 118

118

we actually got an error 119

119

and the error is saying the caplet spoof could not be found. 120

120

So I'm suspecting I made a spelling mistake and I did. 121

121

As you can see, I actually named the caplet soof not spoof. 122

122

So I actually make a lot of mistakes like this. 123

123

So I'm just gonna rename this to spoof 124

124

and we're gonna go back here. 125

125

I'm gonna exit and run the same command again, and perfect. 126

126

As you can see, we got no errors at all. 127

127

If I do help, as you can see 128

128

automatically we have this spoof is running. 129

129

We have the probe, the recon, and the sniff all running 130

130

as soon as we run Bettercap. 131

131

If you remember the first time we ran it, 132

132

we only had the stream running 133

133

and we had to do everything manually 134

134

and set the options manually. 135

135

So this is a really, really nice way of doing it. 136

136

Now let's confirm that everything is working as expected. 137

137

So I'm gonna go to the windows machine 138

138

and we're gonna do ARP-a again. 139

139

And perfect, as you can see, the routers MAC address 140

140

has changed to the same MAC address as the kali machine 141

141

and the original routers MAC address, 142

142

the correct one was this. 143

143

So this means that this windows machine 144

144

is now spoofed, thinking that the kali machine is the router 145

145

and the router now thinks 146

146

that the kali machine is this machine. 147

147

This will place kali in the middle of the connection. 148

148

And just to confirm this, just real quick, 149

149

I'm already in vulnweb. 150

150

This is the website that we tested the login before. 151

151

I'm actually even still logged in. 152

152

So I'm gonna log out, log in again, 153

153

and I'm gonna leave the username to admin 154

154

and I'm just gonna put a password again, 155

155

one, two, three, four to nine zero, enter. 156

156

Let's go back and perfect. 157

157

As you can see, we wouldn't be able to get this 158

158

if we were not in the middle of the connection. 159

159

So the fact that we're getting all of this information 160

160

means that we managed to intercept the data 161

161

and see everything the target user sends or receives. 162

162

And again we have the username and the password right here. 163

163

Like I said, this will only work with HTTP. 164

164

We will discuss HTTPS in the next lectures. 165

165

But in this lecture I just wanted to show you an easy way 166

166

of scripting the commands that you often run with Bettercap 167

167

because in the future 168

168

we're gonna be doing a number of things 169

169

that rely on us being the man in the middle. 170

170

So because I don't want to waste time 171

171

enabling all of the modules that we're running here. 172

172

So again, if I right click this 173

173

and open with a normal text editor, 174

174

all you'll have to do is just put your commands in a file, 175

175

give a file a specific name, 176

176

and then when you're on Bettercap, all you have to do 177

177

is just use the caplet argument, 178

178

followed by the name of your caplet file.