Elvis Wiki - User contributions [en]

NFCGate: Setup and Execution of a Relay Attack

2025-10-23T20:39:36Z

VKrennwallner: /* Requirements */

== Summary ==

We used NFCGate to do a relay attack. In this attack, the data from a real card is sent to a phone and then to the card reader. The card doesn’t need to be close to the reader. This can be used to trick the system, for example in contactless payments or door access.

== Architecture ==

The following diagram illustrates the architecture we used to implement our relay attack. One smartphone functions as the Tag, while the other acts as the Reader. Communication between the two devices is routed through a server, which for the purpose of this project, was hosted on a laptop.

[[File:Architecture.jpg|500px]]

== Requirements ==

=== smartphones used ===
* Samsung Galaxy A40
* LG nexus 5G

=== smartphone Applications ===
* Magisk v26.0 [1]
* LineagesOS v18.1 [2]
* NFC Gate [[#Smartphones|install NFC Gate]]
=== Laptop Applications ===
* NFC Gate Server [[#Ubuntu Server|install NFC Server]]

== Installation ==

=== Smartphones ===

==== Download NFC Gate ====

Download the APK v2.4.4.apk: [https://github.com/nfcgate/nfcgate/releases Download NFCGate]

==== Install NFC Gate ====

Install via ADB:

adb install Downloads/NFCGate.2.4.4.apk

=== Ubuntu ===

==== Download NFC Server ====

Create a folder:

mkdir nfcGate
cd nfcGate

==== Install NFC Server ====

Clone the repository:

sudo git clone https://github.com/nfcgate/server.git

== Attack ==

=== Hotspot ===

Enable hotspot from smartphone and connect the server (Ubuntu)

=== Run server ===

go to the folder:

cd nfcGate/server

run the server:

python3 server.py

[[File:ServerListening.png|550px]]

=== Ip server ===

Check the IP address (from hotspot)

ip a

[[File:IpHotspot.png|450px]]

=== NFC Gate settings ===

Open the NFCGate app and go to settings:

[[File:AppNFCGate.png|150px]] [[File:NfcGateMenue.jpg|150px]]

Go to "Hostname and Port":

[[File:HostnamePortnumber.jpg|150px]]

The hostname is the same IP address as the server:

[[File:NFCGateHostname.jpg|150px]] [[File:IpHotspot.png|450px]]

Port number is always '''5566''':

[[File:NFCGatePortnumber.jpg|150px]]

In the NFCGate app, go to '''Relay mode'''.
Use the '''Tag''' option for the card and the '''Reader''' option for the NFC terminal.

[[File:RelayModeReaderTag.jpg|200px]]

Now you have a connection through the server:

[[File:ConnectionStatus.jpg|200px]]

=== Relay Attack ===

Hold the smartphone with the '''Tag''' side near the card:

[[File:SmartphoneToCard.jpeg|150px]]

Hold the smartphone with the '''Reader''' side near the terminal:

[[File:PhoneToAutomate.jpg|200px]]

== Used Hardware ==

* 2 Smarthones with root and [[https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md Compatibility]]
* Laptop as Server [[https://ubuntu.com/download/desktop Ubuntu]]

== References ==

* 1. https://github.com/topjohnwu/Magisk/releases
* 2. https://github.com/LSPosed/LSPosed
* https://github.com/nfcgate/nfcgate
* https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md
* https://github.com/nfcgate/server
* https://ubuntu.com/download/desktop

[[Category:Documentation]]

ANT-2YAG16 - YAGI-Antenne, 2400 bis 2483MHz, +16dBi, 2m langes Kabel, SMA-Steckverbinder

2025-09-29T08:44:24Z

VKrennwallner:

{{Device|device_name=ANT-2YAG16 - YAGI-Antenne, 2400 bis 2483MHz, +16dBi, 2m langes Kabel, SMA-Steckverbinder|manufacturer=RF Solutions|link=https://at.farnell.com/rf-solutions/ant-2yag16/ant-2-4ghz-yagi-2m-koax-sma-16dbi/dp/2305887?srsltid=AfmBOoo_0eHxC2o97eN37JI-cHUzSFvkSWjPD1pmSSXYEad72hBfpvI3|image_link=https://stuff.elvis.science/uploads/models/yagijpg.jpg|description=|technicalSpecification=https://at.farnell.com/rf-solutions/ant-2yag16/ant-2-4ghz-yagi-2m-koax-sma-16dbi/dp/2305887?srsltid=AfmBOoo_0eHxC2o97eN37JI-cHUzSFvkSWjPD1pmSSXYEad72hBfpvI3|supportedTechnologies=|includedEquipment=|elviscategory=Networking}}

Alfa AWUS036NHA Long Range USB Adapter

2025-09-29T08:42:23Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036NHA Long Range USB Adapter|manufacturer=Alfa Network|link=https://www.alfa.com.tw/products/awus036nha?variant=36473966166088|image_link=https://stuff.elvis.science/uploads/models/164-alfalrjpg.jpg|description=long-range WiFi USB adapter|technicalSpecification=https://alfa-network.eu/media/sparsh/product_attachment/UG-AWUS036NHA_1.pdf?srsltid=AfmBOopMlucP6VE-95Nul3PMzF6YIre1apB-2SfoGWSMlyxcGpTqk04N|supportedTechnologies=WiFi 802.11b,g,n 2,4 GHz, USB 2.0|includedEquipment=1x Alfa adapter, 1x antennas, 1x USB cable, 1x montage kit|elviscategory=Networking}}

Alfa AWUS036NHA Long Range USB Adapter

2025-09-29T08:41:23Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036NHA Long Range USB Adapter|manufacturer=Alfa Network|link=https://www.alfa.com.tw/products/awus036nha?variant=36473966166088|image_link=https://stuff.elvis.science/uploads/models/164-alfalrjpg.jpg|description=long-range WiFi USB adapter|technicalSpecification=https://www.alfa.net.my/products/Alfa-AWUS036NHA-Atheros-AR9271-Wireless-B-G-N-USB-Adapter/15|supportedTechnologies=WiFi 802.11b,g,n 2,4 GHz, USB 2.0|includedEquipment=1x Alfa adapter, 1x antennas, 1x USB cable, 1x montage kit|elviscategory=Networking}}

Alfa AWUS036EAC AC1200 USB Wireless Adapter

2025-09-29T08:40:28Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036EAC AC1200 USB Wireless Adapter|manufacturer=Alfa Network|link=https://alfa-network.eu/wi-fi/awus036eac?srsltid=AfmBOorzCLlN0I9PCO-Iu8lPRjjz3ukL7FTQdlIo2_rYBWNPSpTdkHhz|image_link=https://stuff.elvis.science/uploads/models/165-alfa1200jpg.jpg|description=usb wireless adapter|technicalSpecification=https://alfa-network.eu/media/sparsh/product_attachment/awus036eac-datasheet.pdf?srsltid=AfmBOoo64mj-yUtkQJQaioRklIzD-9DmGaCZOvqfJg_ymhYkmbjF11Uv|supportedTechnologies=802.11a,b,g,n,ac 300Mbps 2.4GHz or 867Mbps 5GHz, USB 3.0|includedEquipment=USB cable, cable clip, wireless stick|elviscategory=Networking}}

Alfa AWUS036EAC AC1200 USB Wireless Adapter

2025-09-29T08:39:26Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036EAC AC1200 USB Wireless Adapter|manufacturer=Alfa Network|link=https://alfa-network.eu/wi-fi/awus036eac?srsltid=AfmBOorzCLlN0I9PCO-Iu8lPRjjz3ukL7FTQdlIo2_rYBWNPSpTdkHhz|image_link=https://stuff.elvis.science/uploads/models/165-alfa1200jpg.jpg|description=usb wireless adapter|technicalSpecification=https://www.alfa.com.tw/service_1_detail/12.htm|supportedTechnologies=802.11a,b,g,n,ac 300Mbps 2.4GHz or 867Mbps 5GHz, USB 3.0|includedEquipment=USB cable, cable clip, wireless stick|elviscategory=Networking}}

Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

2025-09-29T08:38:28Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|manufacturer=Alfa Network|link=https://www.alfa.com.tw/products/awus036ach_1?variant=40319795789896|image_link=https://stuff.elvis.science/uploads/models/163-alfawidejpg.jpg|description=wide-range 802.11ac dual band WiFi USB adapter|technicalSpecification=https://www.wirelesshack.org/review-alfa-awus036ach-ac-1200-wireless-usb-adapter.html|supportedTechnologies=WiFi 802.11a,b,g,n,ac 2,4 GHz 5 GHz, USB 2.0|includedEquipment=1x Alfa adapter, 2x antennas, 1x USB cable, 1x montage kit|elviscategory=Networking}}

Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

2025-09-29T08:37:12Z

VKrennwallner:

{{Device|device_name=Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|manufacturer=Alfa Network|link=https://www.alfa.com.tw/products/awus036ach_1?variant=40319795789896|image_link=https://stuff.elvis.science/uploads/models/163-alfawidejpg.jpg|description=wide-range 802.11ac dual band WiFi USB adapter|technicalSpecification=https://www.alfa.net.my/webshaper/store/viewProd.asp?pkProductItem=66|supportedTechnologies=WiFi 802.11a,b,g,n,ac 2,4 GHz 5 GHz, USB 2.0|includedEquipment=1x Alfa adapter, 2x antennas, 1x USB cable, 1x montage kit|elviscategory=Networking}}

ALA COACH smart runner - heart rate strap CS009

2025-09-29T08:35:41Z

VKrennwallner:

{{Device|device_name=ALA COACH smart runner - heart rate strap CS009|manufacturer=ALATECH|link=https://www.alatech.com/CS009+BLE+4.0+Heart+Rate+Strap/action-products_detail-did-1038-spec_code1-B.htm|image_link=https://asset.conrad.com/media10/isa/160267/c1/-/de/556021_AB_00_FB/image.jpg?x=640&y=640&format=jpg&ex=640&ey=640&align=center|description=Bluetooth heart rate strap|technicalSpecification=supportedTechnologies: Bluetooth 4.0|supportedTechnologies=Bluetooth 4.0|includedEquipment=1x heart rate strap CS009, 1x band|elviscategory=Smart Home}}

Adafruit ADC Data Conversion IC Development Tools ADS1115 16-Bit ADC

2025-09-27T10:46:33Z

VKrennwallner:

{{Device|device_name=Adafruit ADC Data Conversion IC Development Tools ADS1115 16-Bit ADC|manufacturer=Adafruit|link=https://www.adafruit.com/product/1085?srsltid=AfmBOooER0k5robn7szpYog9fg4LUItxpYaV0lLJ-u-FSl1tKE1xiFe4|image_link=https://stuff.elvis.science/uploads/accessories/accessory-yjfg3sETDd9Mc6e8W0.jpg|description=|technicalSpecification=|supportedTechnologies=|includedEquipment=|elviscategory=}}

Access Point

2025-09-27T10:40:40Z

VKrennwallner:

{{Device|device_name=Access Point|manufacturer=Homematic IP|link=https://homematic-ip.com/en/product/access-point|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-ZWMOiZUhvB.png|description=access point connect smartphone with all Homematic IP devices|technicalSpecification=https://homematic-ip.com/en/product/access-point#technical-data|supportedTechnologies=radio communication 868/869.525 MHz, Ethernet|includedEquipment=1x Access point, 1x plug-in power supply, 1x network cable, 1x user manual|elviscategory=Smart Home}}

Access Point

2025-09-27T10:39:11Z

VKrennwallner:

{{Device|device_name=Access Point|manufacturer=Homematic IP|link=https://homematic-ip.com/en/product/access-point|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-ZWMOiZUhvB.png|description=access point connect smartphone with all Homematic IP devices|technicalSpecification=https://www.homematic-ip.com/en/products/detail/homematic-ip-access-point.html|supportedTechnologies=radio communication 868/869.525 MHz, Ethernet|includedEquipment=1x Access point, 1x plug-in power supply, 1x network cable, 1x user manual|elviscategory=Smart Home}}

Access Point

2025-09-27T10:37:59Z

VKrennwallner:

{{Device|device_name=Access Point|manufacturer=Homematic IP|link=https://homematic-ip.com/de/produkt/access-point|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-ZWMOiZUhvB.png|description=access point connect smartphone with all Homematic IP devices|technicalSpecification=https://www.homematic-ip.com/en/products/detail/homematic-ip-access-point.html|supportedTechnologies=radio communication 868/869.525 MHz, Ethernet|includedEquipment=1x Access point, 1x plug-in power supply, 1x network cable, 1x user manual|elviscategory=Smart Home}}

ABUS smart security WiFi pan/tilt camera, full HD(1080p)

2025-09-27T10:35:13Z

VKrennwallner:

{{Device|device_name=ABUS smart security WiFi pan/tilt camera, full HD(1080p)|manufacturer=ABUS Security Tech Germany|link=https://www.abus.com/int/Archive/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera|image_link=https://stuff.elvis.science/uploads/models/ppic32020-rechts-webljpg.jpg|description=ABUS Smart Security World Wi-Fi Pan/Tilt Indoor Camera|technicalSpecification=https://www.abus.com/int/abusproductsheet.pdf/191189/eng-ZZ|supportedTechnologies=WiFi IEEE 802.11 b/g/n, Ethernet|includedEquipment=1x WiFi Pan/Tilt Camera, 1x Power supply, 5V DC / 1.5A, 1x Network cable 1m, 1x Antenna, 1x Ceiling mount, 1x Mounting material|elviscategory=Smart Home}}

ABUS smart security WiFi pan/tilt camera, full HD(1080p)

2025-09-27T10:32:50Z

VKrennwallner:

{{Device|device_name=ABUS smart security WiFi pan/tilt camera, full HD(1080p)|manufacturer=ABUS Security Tech Germany|link=https://www.abus.com/int/Archive/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera|image_link=https://stuff.elvis.science/uploads/models/ppic32020-rechts-webljpg.jpg|description=ABUS Smart Security World Wi-Fi Pan/Tilt Indoor Camera|technicalSpecification=https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera#Tabcontent1|supportedTechnologies=WiFi IEEE 802.11 b/g/n, Ethernet|includedEquipment=1x WiFi Pan/Tilt Camera, 1x Power supply, 5V DC / 1.5A, 1x Network cable 1m, 1x Antenna, 1x Ceiling mount, 1x Mounting material|elviscategory=Smart Home}}

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T17:04:50Z

VKrennwallner: /* Summary */

== Summary ==

This demonstration illustrates a Man-in-the-Middle (MITM) DNS spoofing attack using the Hak5 Packet Squirrel. By intercepting and altering DNS requests, the Packet Squirrel redirects the target device to a malicious, cloned version of www.google.com. When the victim enters their credentials, these are captured by the attacker for potential exploitation.

Key Learning Points:

* The importance of securing DNS communication against spoofing.

* Understanding how tools like the Packet Squirrel and SET can be used for penetration testing.

* Recognizing the need for HTTPS and DNSSEC to protect sensitive user data

== Requirements ==

[[File:setupsquirrel.png|300px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|300px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|300px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|500px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T17:03:49Z

VKrennwallner: /* Step 3: Execute the Attack */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|300px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|300px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|300px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|500px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T17:03:33Z

VKrennwallner: /* Requirements */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|300px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|300px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|300px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T17:03:22Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|300px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|300px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T17:03:13Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|250px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|300px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:57:29Z

VKrennwallner: /* Step 1: Web Server Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|250px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|250px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.26).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:57:14Z

VKrennwallner: /* Step 2: Configure DNS Spoofing on Packet Squirrel */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|250px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|250px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:55:58Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|250px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==

[[File:squirrelssh.jpg|250px|thumb|right|]]

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:55:43Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==

[[File:squirrelubuntu.png|250px|thumb|right|]]

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:55:29Z

VKrennwallner: /* Requirements */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

[[File:setupsquirrel.png|250px|thumb|right|]]

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:55:14Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power
[[File:setupsquirrel.png|250px|thumb|right|]]

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:55:05Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power
[[File:setupsquirrel.png|250px|thumb|right|]]

== Setup ==
[[File:setupsquirrel.png|250px|thumb|right|]]

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:54:07Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power
[[File:setupsquirrel.png|250px|thumb|right|]]

== Setup ==
[[File:setupsquirrel.png|250px|thumb|right|]]

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:54:00Z

VKrennwallner: /* Requirements */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power
[[File:setupsquirrel.png|250px|thumb|right|]]

== Setup ==
[[File:setupsquirrel.png|250px|thumb|right|]]

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:53:46Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==
[[File:setupsquirrel.png|250px|thumb|right|]]

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:53:30Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel
[[File:setupsquirrel.png|250px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:53:04Z

VKrennwallner: /* Step 3: Execute the Attack */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|250px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:52:52Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|250px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|250px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:52:38Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|250px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:52:29Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|250px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:52:21Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|250px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:52:13Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|200px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:51:55Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:51:13Z

VKrennwallner: /* Step 3: Execute the Attack */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|middle|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|right|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:50:50Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|middle|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:50:40Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:50:11Z

VKrennwallner: /* Setup */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|right|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:49:57Z

VKrennwallner: /* Packet Squirrel Initalization */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|right|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:49:47Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:49:33Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.jpg|400px|thumb|right|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:48:54Z

VKrennwallner: /* Verify Connection */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

[[File:squirrelssh.png|400px|thumb|left|]]

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

File:Squirrelssh.jpg

2024-12-18T16:48:28Z

VKrennwallner:

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:39:08Z

VKrennwallner: /* Used Hardware */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:38:50Z

VKrennwallner: /* Courses */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

To carry out a DNS spoofin g attack using the man-in-the-middle tool, Packet Squirrle, a web server is set up using setoolkit.

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]

Hak5 Packet Squirrel: DNS-Spoofing Demo

2024-12-18T16:38:31Z

VKrennwallner: /* Step 3: Execute the Attack */

== Summary ==

The purpose of this demonstration is to perform a DNS spoofing attack using the Hak5 Packet Squirrel to redirect a target device to a cloned malicious website. This attack aims to capture user credentials by presenting a fake login page that mimics a legitimate website.

== Requirements ==

* Packet Squirrel from Hak5
* target device (Laptop, virtual machine: Ubuntu)
* Network (WLAN-Router)
* Two Ethernet Cable
* One USB Cable to supply Packet Squirrel with power

== Setup ==

* Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
* Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

[[File:setupsquirrel.png|400px|thumb|left|]]

== Packet Squirrel Initalization ==
1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.
* Set the network adapter to Bridge Mode.
* Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.
3. Save the configuration and start the VM.

[[File:squirrelubuntu.png|400px|thumb|left|]]

== Verify Connection ==
1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:
ssh root@172.16.32.1
Password: hak5squirrel

== Step 1: Web Server Setup ==

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

* Shutdown the VM.

* In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

* Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.16).

2. Install and set up the Social-Engineer Toolkit (SET):

sudo apt update
sudo apt install git python3 python3-pip build-
essential
git clone https://github.com/trustedsec/social-
engineer-toolkit.git
cd social-engineer-toolkit
sudo python3 setup.py
sudo setoolkit

3. Configure SET to clone a website:

* Select the following options in SET:

1. Social Engineering Attacks

2. Website Attack Vectors

3. Credential Harvester Attack Method

4. Web Templates

* Enter the POST back IP address (192.168.1.16).

* Choose Google as the website to clone.

== Step 2: Configure DNS Spoofing on Packet Squirrel ==

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.16

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.16).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

== Step 3: Execute the Attack ==

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

[[File:squirrelsignin.png|400px|thumb|left|]]

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

To carry out a DNS spoofin g attack using the man-in-the-middle tool, Packet Squirrle, a web server is set up using setoolkit.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Documentation]]