Machine-in-the-Middle (MitM): General - Revision history

NKirnbauer: NKirnbauer moved page Machine in the Middle (MitM) - General to Machine-in-the-Middle (MitM): General

2024-10-22T17:47:40Z

NKirnbauer moved page Machine in the Middle (MitM) - General to Machine-in-the-Middle (MitM): General

← Older revision	Revision as of 17:47, 22 October 2024
(No difference)

Ikramer at 18:35, 12 March 2024

2024-03-12T18:35:49Z

← Older revision		Revision as of 18:35, 12 March 2024
Line 161:		Line 161:

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:~~Basics~~]]		[[Category:Basic]]

Ikramer at 18:35, 12 March 2024

2024-03-12T18:35:24Z

← Older revision		Revision as of 18:35, 12 March 2024
Line 161:		Line 161:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Basics]]

SKoelly: /* Bettercap */

2024-01-02T13:41:24Z

Bettercap

← Older revision		Revision as of 13:41, 2 January 2024
Line 101:		Line 101:
	net.probe on		net.probe on
	net.show (optional)		net.show (optional)
	set arp.spoof.targets <single ip-address or -range with “-“ in the last octet)		set arp.spoof.targets <single IP-address or -range with “-“ in the last octet>
	net.sniff on		net.sniff on
	http-ui (if you want to see it graphically on 127.0.0.1:80 with user:pass)		http-ui (if you want to see it graphically on 127.0.0.1:80 with user:pass)
Line 108:		Line 108:
	[[File:Bettercap_UI.png\|600px]]		[[File:Bettercap_UI.png\|600px]]

	You can load in further “modules” (either in the UI or) in the terminal, for example to also intercept HTTPS traffic (for ~~website~~ that don’t have HSTS enabled):		You can load in further “modules” (either in the UI or) in the terminal, for example, to also intercept HTTPS traffic (for websites that don’t have HSTS enabled):
	set https.proxy.sslstrip true		set https.proxy.sslstrip true
	https.proxy on		https.proxy on
Line 126:		Line 126:
	sudo ./bettercap		sudo ./bettercap
	net.probe on		net.probe on
	set arp.spoof.targets IP-address		set arp.spoof.targets <single IP-address or -range with “-“ in the last octet>
	set arp.spoof.fullduplex true		set arp.spoof.fullduplex true
	set arp.spoof.internal true		set arp.spoof.internal true
Line 136:		Line 136:
	[[File:Bettercap_HSTS.png\|600px]]		[[File:Bettercap_HSTS.png\|600px]]

	~~Fur~~ further details, please note, that there is also a separate Elvis Wiki article: https://wiki.elvis.science/index.php?title=Bettercap		For further details, please note, that there is also a separate Elvis Wiki article: https://wiki.elvis.science/index.php?title=Bettercap

	== Further common tools you might try out ==		== Further common tools you might try out ==

SKoelly at 13:34, 2 January 2024

2024-01-02T13:34:48Z

← Older revision		Revision as of 13:34, 2 January 2024
Line 153:		Line 153:
	** Can be used as MitM e.g., TLS Interception		** Can be used as MitM e.g., TLS Interception
	** https://portswigger.net/burp/releases		** https://portswigger.net/burp/releases

	~~== Courses ==~~

	* [[A course where this documentation was used]] (2017, 2018)
	* [[Another one]] (2018)

	== References ==		== References ==

	* https://~~wikipedia~~.org		* https://csrc.nist.gov/glossary/term/mitm
	* https://~~google~~.~~com~~		* https://www.ettercap-project.org/index.html
			* https://www.bettercap.org/

	[[Category:Documentation]]		[[Category:Documentation]]

SKoelly: /* Used Hardware */

2024-01-02T13:31:57Z

Used Hardware

← Older revision		Revision as of 13:31, 2 January 2024
Line 138:		Line 138:
	Fur further details, please note, that there is also a separate Elvis Wiki article: https://wiki.elvis.science/index.php?title=Bettercap		Fur further details, please note, that there is also a separate Elvis Wiki article: https://wiki.elvis.science/index.php?title=Bettercap

	== ~~Used Hardware~~ ==		== Further common tools you might try out ==

	~~[[Device~~ to be used ~~with this documentation]]~~		* mitmproxy
	~~[[Maybe another device to~~ be used ~~with this documentation]]~~		** HTTPS Proxy
			** https://mitmproxy.org/
			* hetty
			** (aims to become) open source alternative to Burp Suite Pro
			** https://hetty.xyz/
			* proxy.py
			** Provides many functionalities, including MitM for HTTPS (TLS Interception)
			** https://github.com/abhinavsingh/proxy.py
			* Burp Suite (Community Edition)
			** Widely used penetration testing tool, especially for Web Applications
			** Can be used as MitM e.g., TLS Interception
			** https://portswigger.net/burp/releases

	== Courses ==		== Courses ==

SKoelly: /* Ettercap */

2024-01-02T13:22:53Z

Ettercap

← Older revision		Revision as of 13:22, 2 January 2024
Line 69:		Line 69:
	Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.		Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.

	[[File:Ettercap.png\|~~200px~~]]		[[File:Ettercap.png\|400px]]

	When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.		When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.

SKoelly: /* Ettercap */

2024-01-02T13:22:36Z

Ettercap

← Older revision		Revision as of 13:22, 2 January 2024
Line 69:		Line 69:
	Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.		Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.

	[[File:Ettercap.png\|~~600px~~]]		[[File:Ettercap.png\|200px]]

	When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.		When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.

SKoelly: /* Tools */

2024-01-02T13:22:02Z

Tools

← Older revision		Revision as of 13:22, 2 January 2024
Line 60:		Line 60:

	== Tools ==		== Tools ==
			Taking two famous MitM Tools for demonstration: Ettercap and Bettercap
			There are many tools on the market that facilitate a MitM attack. Two well-known tools should be presented here.

	=== Ettercap ===		=== Ettercap ===

	~~Enter these commands~~ in the ~~shell~~		From the Ettercap website: “Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.” (https://www.ettercap-project.org/index.html, accessed: 22.12.2023)

	~~echo foo~~		Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.
	~~echo bar~~
			[[File:Ettercap.png\|600px]]

			When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.
			As can be seen in the screenshot below, Ettercap provides many options for MitM attacks.

			In this case, we want to focus on ARP Spoofing/Cache Poisoning (first option).

			[[File:Ettercap_ARP.png\|600px]]

			In the following, a general step-by-step guide will be given on how one could do ARP Spoofing/Cache Poisoning.

			1. Scan hosts on the network by clicking the three dots in the upper right corner  Scan for Hosts
			2. Select hosts by clicking on the three dots in the upper right corner  Host List  Select the victims (e.g., clients) and add them to Target 1. Select (e.g.,) the gateway and add them to Target 2.
			3. Click on the “world-“symbol (see the screenshot above) and click ARP poisoning.
			4. In the next opening window, click “OK”.
			5. The ARP Spoofing attack should now be running. You can very that with e.g., Wireshark.

			Further attacks are now possible, e.g., by intercepting encrypted web traffic (i.e., HTTPS/TLS).

	=== Bettercap ===		=== Bettercap ===

SKoelly: /* How to prevent MitM? */

2024-01-02T13:18:30Z

How to prevent MitM?

← Older revision		Revision as of 13:18, 2 January 2024
Line 57:		Line 57:

	== How to prevent MitM? ==		== How to prevent MitM? ==
			Preventing a MitM is as diverse as the attacks and techniques are. Going into detail would go beyond the scope of this article, but just to mention a few ideas: use of encrypted protocols (HTTPS with TLS 1.3, WPA3 for WiFi), intrusion detection/prevention systems (monitoring of network traffic), specialized solutions to specific threats/attacks (e.g., block packets with spoofed source addresses), update systems to patch known vulnerabilities and (as always) education of users (especially in corporate environments) that they should not access sensitive data over the Internet from an insecure WiFi.

	== Tools ==		== Tools ==