MITM/Wired/ARP Poisoning with Ettercap - Revision history

Unknown user: /* What HTTPS Does Not Protect */

2022-03-05T21:04:55Z

What HTTPS Does Not Protect

← Older revision		Revision as of 21:04, 5 March 2022
Line 250:		Line 250:
	==What HTTPS Does Not Protect==		==What HTTPS Does Not Protect==

	HTTPS encrypts your traffic. HTTPS does NOT obfuscate the destination of the traffic.		HTTPS encrypts your traffic. HTTPS does NOT obfuscate the destination of the traffic. Using HTTPS, the destination of your traffic is NOT hidden.

	~~Repeat: if you're using HTTPS, the destination of your traffic is NOT hidden.~~		Let's look at an example: when I fire up the Jupiter server, the sheep in the MITM attack, and I visit https://en.wikipedia.org and I log in with my MediaWiki username and password, an attacker performing a MITM attack will mainly just see traffic passing between Jupiter and a certificate authority (multiple IP addresses, but all registered under Verisign, a Certificate Authority.) I cannot sniff any packets going to external addresses because those are going through HTTPS tunnels that Wireshark doesn't "see".

	Let's look at an example: when I fire up Jupiter, the sheep in the ~~man-in-the-middle~~ attack, and I visit https://en.wikipedia.org and I log in with my MediaWiki username and password, an attacker performing a ~~man-in-the-middle~~ attack will mainly just see traffic passing between Jupiter and a certificate authority (multiple IP addresses, but all registered under Verisign, a Certificate Authority.) I cannot sniff any packets going to external addresses because those are going through HTTPS tunnels that Wireshark doesn't "see".

	'''HOWEVER, an attacker can still see the destination of HTTPS traffic!!!''' While your traffic consists almost entirely of TCP packets between you and a certificate authority (IP addresses owned by Verisign), there is one key packet that an attacker may look at to see the destination of your HTTPS traffic by looking through a [[Wireshark]] traffic dump: the "Server Hello, Certificate, Server Hello Done" packet.		'''HOWEVER, an attacker can still see the destination of HTTPS traffic!!!''' While your traffic consists almost entirely of TCP packets between you and a certificate authority (IP addresses owned by Verisign), there is one key packet that an attacker may look at to see the destination of your HTTPS traffic by looking through a [[Wireshark]] traffic dump: the "Server Hello, Certificate, Server Hello Done" packet.

Unknown user: /* Using HTTPS (Partial Protection) */

2022-03-05T21:04:01Z

Using HTTPS (Partial Protection)

← Older revision		Revision as of 21:04, 5 March 2022
Line 230:		Line 230:
	==Using HTTPS (Partial Protection)==		==Using HTTPS (Partial Protection)==

	Now we will switch to the scenario where you are the Sheep. What can you do to protect yourself from wolves performing ~~man-in-the-middle~~ attacks?		Now we will switch to the scenario where you are the Sheep. What can you do to protect yourself from wolves performing MITM attacks?

	One way to protect yourself against an ARP cache poisoning attack is to use HTTPS ~~(by way of~~ Firefox extension HTTPS Everywhere, more info at the [[Anonymous Browsing]] page).		One way to protect yourself against an ARP cache poisoning attack is to use HTTPS. Firefox extension HTTPS Everywhere can help - more info at the [[Anonymous Browsing]] page.

	Using HTTPS prevents a ~~man-in-the-middle~~ attacker from being able to sniff the contents of your traffic. The ~~attacker will sniff your~~ traffic ~~and will mostly see TCP packets between you and~~ a ~~certificate authority~~.		Using HTTPS prevents a MITM attacker from being able to sniff the contents of your traffic, and makes it much, much more difficult to spoof the endpoint. The traffic is now protected by math, instead of by network routes. Spoofing a MAC address or packet source is very easy - but spoofing a crypotgraphic key is difficult.

	~~Using HTTPS~~ will also warn ~~you~~ when certificates are fishy, ~~indicating a man-in-~~the~~-middle who does~~ not ~~have the private key of Google.com or Wikipedia.org and so cannot present~~ a ~~valid certificate for HTTPS~~.		Browsers will also warn when HTTPS certificates are fishy (expired, suspicious, for the wrong domain, or not signed by a trusted root certficiate authority).

	HOWEVER, understand the limitations of this protection.		HOWEVER, understand the limitations of this protection.

	~~If someone is conducting~~ a ~~Man in the Middle attack~~, ~~then~~ every ~~HTTPS site you visit~~ will show ~~you the same~~ warning, about an invalid ~~certificate~~:		During an MITM attack, a Sheep machine would not be able to establish HTTPS connections with outside websites, because every certificate presented by an attacker would have to be spoofed (an correctly spoofing a certificate is mathematically hard). So, the browser will show a warning about invalid certificates on every site:

	[[Image:FirefoxInvalidCertificate.png\|500px]]		[[Image:FirefoxInvalidCertificate.png\|500px]]

	~~The~~ danger is in accepting ~~this invalid certificate. When you accept the~~ invalid certificate ~~for that site~~, Firefox ~~will~~ permanently store that certificate~~, and every~~ time you visit ~~that~~ site, ~~when~~ the ~~attacker with that~~ certificate ~~is conducting a Man in the Middle attack~~, ~~your browser will~~ silently accept the attacker's certificate.		There is a danger in accepting (even by accident) that invalid certificate, since Firefox would permanently store that certificate as a trusted certificate. Each time you visit any site via HTTPS, the forged certificate would be presented, and Firefox would silently accept the attacker's certificate because it is trusted.

	The moral is, never accept invalid certificates, ever, unless you trust your connection.		The moral is, never accept invalid certificates, ever, unless you trust your connection.

Unknown user: /* Duplicate Traffic */

2022-03-05T20:56:42Z

Duplicate Traffic

← Older revision		Revision as of 20:56, 5 March 2022
Line 218:		Line 218:
	==Duplicate Traffic==		==Duplicate Traffic==

	When you conduct a ~~Man in the Middle~~ attack, on a wired network your computer will be forwarding every packet that is not destined for it - meaning there will be lots of duplicate traffic generated by an attacker, which will show up as swarms of black packets:		When you conduct a MITM attack, on a wired network your computer will be forwarding every packet that is not destined for it - meaning there will be lots of duplicate traffic generated by an attacker, which will show up as swarms of black packets:

	[[Image:WiresharkEttercapBlackPackets.png\|500px]]		[[Image:WiresharkEttercapBlackPackets.png\|500px]]

	~~The way~~ to ~~overcome this is not to use~~ ARP poisoning~~, but to use~~ a physical network tap ~~instead~~. See [[~~Man in the Middle~~/Wired/Network Tap]]		An alternative method to ARP poisoning would be using a physical network tap.

			See [[MITM/Wired/Network Tap]]

	=Protecting Yourself=		=Protecting Yourself=

Unknown user: /* Setting Off Intrusion Detection */

2022-03-05T20:55:58Z

Setting Off Intrusion Detection

← Older revision		Revision as of 20:55, 5 March 2022
Line 210:		Line 210:
	==Setting Off Intrusion Detection==		==Setting Off Intrusion Detection==

	~~Only perform this man in the middle attack on tiny home networks where the user never looks at their network traffic.~~ If ~~the~~ network is administered, if anyone ~~watches~~ network traffic, or if any intrusion detection systems (~~IDS~~) are in place on the network, ~~you~~ will be ~~found out~~ immediately. ~~This attack~~ is very easy to spot when looking at a packet capture:		If a network is administered, if anyone monitors anomalous network traffic, or if any intrusion detection/prevention systems (IDPS) are in place on the network, the attack will be immediately discovered. ARP poisoning is very easy to spot when looking at a packet capture:

	[[Image:WiresharkDuplicateUseOfIP.png\|500px]]		[[Image:WiresharkDuplicateUseOfIP.png\|500px]]

Unknown user: /* Warnings */

2022-03-05T20:55:10Z

Warnings

← Older revision		Revision as of 20:55, 5 March 2022
Line 202:		Line 202:
	==Making the Sheep Suspicious==		==Making the Sheep Suspicious==

	When using this method of ~~man-in-the-middle~~ in a naive way, the user is apt to notice. Each time they visit an HTTPS site, they will see a warning notifying them that the site's certificate couldn't be verified.		When using this method of MITM in a naive way, the user is apt to notice. Each time they visit an HTTPS site, they will see a warning notifying them that the site's certificate couldn't be verified.

	The sheep will see this message on every HTTPS page they visit, so after a few times they would become suspicious that they were being attacked.		The sheep will see this message on every HTTPS page they visit, so after a few times they would become suspicious that they were being attacked.

Unknown user: /* Wireshark for Traffic Analysis */

2022-03-05T20:53:28Z

Wireshark for Traffic Analysis

← Older revision		Revision as of 20:53, 5 March 2022
Line 86:		Line 86:
	==Wireshark for Traffic Analysis==		==Wireshark for Traffic Analysis==

	Now fire up [[Wireshark]] so that we can do a packet capture of our ~~man-in-the-middle~~ session. Start a capture on the <code>eth0</code> network interface (which is a network cable connected to the router, the same router that the sheep is connected to).		Now fire up [[Wireshark]] so that we can do a packet capture of our MITM session. Start a capture on the <code>eth0</code> network interface (which is a network cable connected to the router, the same router that the sheep is connected to).

	===Test Wireshark Sniffing===		===Test Wireshark Sniffing===

	Once the packet capture has started, we can test out Wireshark's abilities to sniff out regular traffic. By running an ARP Poisoning ~~man-in-the-middle~~, we are able to see all traffic to the Sheep as though we were physically sitting at the same network port as them.		Once the packet capture has started, we can test out Wireshark's abilities to sniff out regular traffic. By running an ARP Poisoning MITM, we are able to see all traffic to the Sheep as though we were physically sitting at the same network port as them.

	Test browse some unencrypted websites on your Sheep computer. Take a look at the Wireshark dumps. You should see a whole bunch of GET requests and traffic between the target and the destination:		Test browse some unencrypted websites on your Sheep computer. Take a look at the Wireshark dumps. You should see a whole bunch of GET requests and traffic between the target and the destination:

Unknown user: Admin moved page Man in the Middle/Wired/ARP Poisoning with Ettercap to MITM/Wired/ARP Poisoning with Ettercap

2022-03-05T20:41:02Z

Admin moved page Man in the Middle/Wired/ARP Poisoning with Ettercap to MITM/Wired/ARP Poisoning with Ettercap

← Older revision	Revision as of 20:41, 5 March 2022
(No difference)

Admin: /* What HTTPS Does Not Protect */

2018-10-26T23:14:40Z

What HTTPS Does Not Protect

← Older revision		Revision as of 23:14, 26 October 2018
Line 266:		Line 266:
	First thing, if I filter on the IP address of the sheep and look at the DNS requests being sent, the destination of the HTTPS traffic can be seen in the clear:		First thing, if I filter on the IP address of the sheep and look at the DNS requests being sent, the destination of the HTTPS traffic can be seen in the clear:

	[[Image:WiresharkEttercapDns.png]]		(A long lost image: [[Image:WiresharkEttercapDns.png]])

	HTTPS is a way of encrypting the contents of HTTP packets. It doesn't affect DNS packets, or TCP packets, or any other kind of traffic other than HTTP.		HTTPS is a way of encrypting the contents of HTTP packets. It doesn't affect DNS packets, or TCP packets, or any other kind of traffic other than HTTP.

Admin: /* Install Tools */

2015-08-30T05:12:19Z

Install Tools

← Older revision		Revision as of 05:12, 30 August 2015
Line 34:		Line 34:
	The attacker will use a couple of different tools to perform the man in the middle attack.		The attacker will use a couple of different tools to perform the man in the middle attack.

	The attacker will absolutely need [[Ettercap]] and [[Wireshark]] to get the attack up and running.		The attacker will absolutely need [[Ettercap]] and [[Wireshark]] to get the attack up and running. See the [[Ettercap]] page for the apt-get list of things you'll need if you're installing Ettercap from source.

	The attacker may want to use [[Driftnet]] to analyze traffic during the attack.		The attacker may want to use [[Driftnet]] to analyze traffic during the attack.

Admin: /* Perform MITM with Ettercap */

2015-08-30T03:01:02Z

Perform MITM with Ettercap

@@ Line 187: / Line 187: @@
 $ ettercap -T -q -i eth0 -M arp /10.0.0.1/10.0.0.75/
 </pre>
 =Warnings=