MITM/Traffic Injection - Revision history

Unknown user: Admin moved page Man in the Middle/Traffic Injection to MITM/Traffic Injection

2022-03-05T20:40:08Z

← Older revision	Revision as of 20:40, 5 March 2022
(No difference)

2016-08-23T02:15:48Z

Custom Proxy Module: MySQL Eavesdropping

← Older revision		Revision as of 02:15, 23 August 2016
Line 109:		Line 109:
	===Custom Proxy Module: MySQL Eavesdropping===		===Custom Proxy Module: MySQL Eavesdropping===

	The bettercap documentation has a nice example of using the TCP proxy to eavesdrop on ~~MySQL~~ traffic: https://www.bettercap.org/docs/proxying/tcp.html		The bettercap documentation has a nice example of using the TCP proxy to eavesdrop on TCP traffic: [https://www.bettercap.org/docs/proxying/tcp.html]

	These register TCP packets as events. Here is a link to bettercap's Ruby documentation with more info about event objects: http://www.rubydoc.info/gems/bettercap/1.5.0/BetterCap/Proxy/TCP/Event		These register TCP packets as events. Here is a link to bettercap's Ruby documentation with more info about event objects: [http://www.rubydoc.info/gems/bettercap/1.5.0/BetterCap/Proxy/TCP/Event]

	Let's create a custom proxy module called eavesdrop_mysql.rb, which has the following contents:		Let's create a custom proxy module called eavesdrop_mysql.rb, which has the following contents:

2016-08-23T01:58:55Z

Custom Proxy Module: Replacing Images

@@ Line 106: / Line 106: @@
 To see more information, check out the MITM labs: [[MITM Lab/Bettercap to Replace Images]]
 ==Flags==
 {{MITMFlag}}

2016-08-23T01:52:00Z

injecthtml Proxy Module: Replacing Images

← Older revision		Revision as of 01:52, 23 August 2016
Line 35:		Line 35:
	This will print out the bettercap help, with info about the injecthtml module at the very bottom.		This will print out the bettercap help, with info about the injecthtml module at the very bottom.

	===~~injecthtml~~ Proxy Module: Replacing Images===		===Custom Proxy Module: Replacing Images===

	As a quick example, let's use an example from the bettercap proxy modules repo to illustrate how all of this fits together.		As a quick example, let's use an example from the bettercap proxy modules repo to illustrate how all of this fits together.

2016-08-23T01:50:03Z

Replacing Images

← Older revision		Revision as of 01:50, 23 August 2016
Line 35:		Line 35:
	This will print out the bettercap help, with info about the injecthtml module at the very bottom.		This will print out the bettercap help, with info about the injecthtml module at the very bottom.

	===Replacing Images===		===injecthtml Proxy Module: Replacing Images===

	As a quick example, let's use an example from the bettercap proxy modules repo to illustrate how all of this fits together.		As a quick example, let's use an example from the bettercap proxy modules repo to illustrate how all of this fits together.

2016-08-22T22:25:06Z

Replacing Images

← Older revision		Revision as of 22:25, 22 August 2016
Line 104:		Line 104:

	[[Image:OhaiSuccess.jpg\|500px]]		[[Image:OhaiSuccess.jpg\|500px]]

			To see more information, check out the MITM labs: [[MITM Lab/Bettercap to Replace Images]]

	==Flags==		==Flags==

	{{MITMFlag}}		{{MITMFlag}}

2016-08-22T22:13:47Z

Replacing Images

← Older revision		Revision as of 22:13, 22 August 2016
Line 100:		Line 100:
	--gateway 192.168.0.1 --target 192.168.0.7		--gateway 192.168.0.1 --target 192.168.0.7
	</pre>		</pre>

			This worked like a charm. I ran the script on the attacker, closed the browser on the sheep, gave it about 15 seconds, and then opened the browser. It slows down the loading time by a substantial amount - but as you can see, it's worth it:

			[[Image:OhaiSuccess.jpg\|500px]]

	==Flags==		==Flags==

	{{MITMFlag}}		{{MITMFlag}}

2016-08-22T22:03:16Z

Replacing Images

← Older revision		Revision as of 22:03, 22 August 2016
Line 90:		Line 90:
	[[Image:Ohai.jpg\|200px]]		[[Image:Ohai.jpg\|200px]]

	Pick a directory to put your materials into. This directory will contain a folder called img/, which will contain images being served up, specifically hack.jpg. It will also contain replace_images.rb, the ruby script above. Now we can run bettercap from this directory, specifying the custom Ruby proxy module with the <code>--proxy-module ~~ReplaceImages~~</code> argument. You will also need to set the <code>--httpd</code> and <code>--httpd-path</code> options to run an http server, from the directory that contains your hack.jpg image, to serve up the image to the sheep.		Pick a directory to put your materials into. This directory will contain a folder called img/, which will contain images being served up, specifically hack.jpg. It will also contain replace_images.rb, the ruby script above. Now we can run bettercap from this directory, specifying the custom Ruby proxy module with the <code>--proxy-module replace_images</code> argument. You will also need to set the <code>--httpd</code> and <code>--httpd-path</code> options to run an http server, from the directory that contains your hack.jpg image, to serve up the image to the sheep.

	The whole thing looks like this:		The whole thing looks like this:

2016-08-22T21:56:00Z

Replacing Images

← Older revision		Revision as of 21:56, 22 August 2016
Line 40:		Line 40:

	The ruby script [https://raw.githubusercontent.com/evilsocket/bettercap-proxy-modules/master/http/replace_images.rb] is given below:		The ruby script [https://raw.githubusercontent.com/evilsocket/bettercap-proxy-modules/master/http/replace_images.rb] is given below:

			'''replace-images.rb'''

	<pre>		<pre>
Line 94:		Line 96:
	<pre>		<pre>
	bettercap -I wlan2 -O bettercap_proxy.log -S ARP -X \		bettercap -I wlan2 -O bettercap_proxy.log -S ARP -X \
	--proxy --proxy-module ~~ReplaceImages~~ \		--proxy --proxy-module replace_images \
	--httpd --httpd-path img \		--httpd --httpd-path img \
	--gateway 192.168.0.1 --target 192.168.0.7		--gateway 192.168.0.1 --target 192.168.0.7

2016-08-22T21:53:30Z

Replacing Images

← Older revision		Revision as of 21:53, 22 August 2016
Line 88:		Line 88:
	[[Image:Ohai.jpg\|200px]]		[[Image:Ohai.jpg\|200px]]

	~~We'll~~ put ~~this image~~ into hack.jpg, ~~and put that in~~ the ~~same~~ directory as the ~~ruby~~ code ~~above~~, ~~which we'll call replace_images~~.rb.		Pick a directory to put your materials into. This directory will contain a folder called img/, which will contain images being served up, specifically hack.jpg. It will also contain replace_images.rb, the ruby script above. Now we can run bettercap from this directory, specifying the custom Ruby proxy module with the <code>--proxy-module ReplaceImages</code> argument. You will also need to set the <code>--httpd</code> and <code>--httpd-path</code> options to run an http server, from the directory that contains your hack.jpg image, to serve up the image to the sheep.

	~~Now run bettercap with the~~ <~~code~~>--httpd~~</code> and <code>~~--httpd-path</~~code~~> ~~options to run an http server, from the directory that contains your hack.jpg image, to serve up the image content to the sheep.~~		The whole thing looks like this:

			<pre>
			bettercap -I wlan2 -O bettercap_proxy.log -S ARP -X \
			--proxy --proxy-module ReplaceImages \
			--httpd --httpd-path img \
			--gateway 192.168.0.1 --target 192.168.0.7
			</pre>

	==Flags==		==Flags==

	{{MITMFlag}}		{{MITMFlag}}