All language subtitles for 2. Sniffing Captive Portal Login Information Using ARP Spoofing

This lecture I'd like to show you another way of bypassing CAPTA portals since the captive portal is

an open network.

We can just connect to it normally and once we connect we'll get an IP address and everything.

And what we'll do in that case will run a normal IRP spoofing attack.

Now as we know this attack will place us in the middle of the connection between the client and the

router.

And this way all the data will flow through our computer including usernames passwords your elves and

everything.

The advantage of this method is because the data will flow through our computers so we're going to become

the man in the middle.

And because we don't have Internet access through this network then when we do this attack the clients

that we are targeting will automatically lose their connection and will automatically be asked to enter

the username and password without having to do the authentication attack for us.

The reason for this like I said because every request they send will be redirected to our computer our

computer will send the request to the router.

The response will be that we don't have connection.

The router will ask us to log in so that the response will be forwarded to the client and the client

will automatically be asked to log in again.

So let me show you I have my Windows machine here and this Windows machine is connected so we can search

for anything we can search for tests for example and that will work.

So this machine has Internet connections already authenticated with the network and they're happy they're

using their internet connection.

Now what we're going to do is we're going to go back to Cali.

We'll first connect to the network.

So I'm going to go up my wireless adapter is already connected to Cali and it's in managed mode.

It's not in monitor mode because you can't connect to networks when you're in motor mode.

So I'm going to go on the Wi-Fi.

I'm going to select a network and I'm going to select my target network which is Airport hotspot.

I'm going to connect and wait for it until it gets connected.

And now that I'm connected I'm just going to go on Firefox just to show you that I actually don't have

connection now so I'm just connected to the network but I don't have internet connection.

I have to log in put my username and password to access the Internet.

So let's try to go to big dotcom.

And as you can see I get asked to enter a password.

So we're coming here.

We're going to do a normal peaceful attack.

So there is a number of ways to do this.

You can use a spoof like I showed you before and then sniff the data using Wireshark.

Alternatively you can use mine in the middle left and just do mine in the middle of a piece poof live

with the interface which is like 0 said the gateway which is in our case we can just split the screen

here and do route and and we can see it's 1 9 2 1 6 8 2 1.

So we just do 1 9 2 6 8 to 1 hit enter.

It'll put you in the middle of the connection and then when the target enters the password you'll capture

it.

Now I've already showed you how to use my in the middle level before and I know some people actually

face issues with running it against Real Networks.

Now I've suggested a lot of solutions for it and the solutions usually work.

But what I want to show you in this lecture since you already know how to use man anti-Middle if I'm

going to show you another tool that I really really like and I used to use even before my intimate life

even existed.

The thing is this tool went out of date for a while and now it's actually being developed again and

people are updating it again.

So it works just as good as it used to be.

Now I'm going to clear this and the name of this tool is it a cup.

Now you probably heard of it so we can use it took up to do a large number of things including becoming

the man in the middle using a sharpie spoofing.

So this is what we're interested in.

We're going to do it hookup we're going to do minus T.

Q To tell it I want to run and textmode and I want this text more to be quiet so that's what the T and

Q stands for.

We're going to tell it minus and to give it the mode that we want to run in.

And we wanted to do IRP spoofing.

So we're going to do AARP remote.

We're going to give it the interface.

And finally we want to target all the computers we don't have one specific target and the password will

do will allow us to log into the target network.

So we're happy with anything that we get.

So we're just going to do three forward slashes to say that I want you to target all the clients in

the current network.

So like I said you can use Matt and them into life if you're comfortable with it using this command

and that will work.

I'm just showing this example to show you another tool that I really really like and it actually works

very very well.

So the name of the tool is it or cub.

We're telling you that we want you to run in text mode and I want this text not to be quiet.

We're giving it the mode or the attacks that we want to run.

And that attack is a R.P. spoofing.

So for it or copy you have to type it as a RPO remote.

We're giving it the interface.

And then at the end you have to specify the targets with a cup because we don't have a specific target.

We're putting three forward slashes to say that I want you to target all the clients in the current

network.

Now I'm going to hit enter

and now as you can see it's our cubs who are can and are still enemy that it's target in all the hosts

in the list which means all the clients in the network.

Now if you want to confirm that this attack is working.

You can go on the Windows machine and check the table make sure that the router's mac address changed

to the Callimachi has MAC address.

You don't have to do that.

You can just do that to confirm that it's working.

But now if I come to the Windows machine here you can see that it's automatically shown me the bar on

top saying that I need to log in even though I had log into this network.

I could I could use the Internet and do anything I want.

Now if I try to go to any different web page

you'll see that it's automatically redirect me to the log in page and it's literally preventing me from

going anywhere.

Even though this client has already signed into this network it should already have access to the Internet.

The reason for this is because any request.

Now this client sense is being sent to the Callimachi in the Callimachi does not have access to the

Internet.

So the response that Kelly gets is this page therefore Carly forward this response to this computer

which is being poisoned.

And that's why we're seeing this log in page.

So again you don't have to do the authentication attack in this case the user will automatically be

asked to log in.

So now the user has nothing to do but to enter their password again.

So let's put the password hit enter.

Now it's trying to take me to google and complaining about secure connection because the person is in

the middle of the connection.

But now the user has internet connections so they go to being dot com.

They have their internet connection.

Everything is back to normal.

They're happy they can browse again.

If we go to Kelly again we won't have to go to wireshark this time because it's a couple automatically

analyze the data for us just like in the middle left.

So as you can see it captured that there was a request for a username and the password was 1 2 3 4 5

6 and the log in was submitted through this page.

Now we can't quit our shark by type in queue and the keyboard and that's it.

Now we can just go try to Briar's any page and tell you the password 1 2 3 4 5 6 and that's it.

We have access to the captive portal.

Now again the really cool thing about this method is you don't have to do the authentication attack.

And even if the user has already logged in and authenticated with the network they'll automatically

be asked to enter their log in credentials again and you'll automatically be able to see the password

without having to go to our shark and analyze the data because again it's our cap or man in the middle

life will do the hard work for you.