Actively sniffing and spoofing using Cain and Abel

In Part 1 (link) active sniffing and performing a man-in-the-middle attack were introduced. It allows you to intercept between the communication of two clients and thus able to read all their conversation. In this part tools will be demonstrated with which such an attack can be performed.

We will begin with one of the most easy to use and robust tools called Cain and Abel. It is composed of two components, first being Cain which is can perform a host of features such as:

a) Sniffing
b) Man-in-the-middle attack
c) Bruteforce and dictionary based hash cracking
d)Windows logon password cracking

The lesser known component, Abel can be also be pretty useful. The two utilities compliment each other in the sense that Cain is used to remotely execute attacks whereas Abel has to be installed on the victim machine as a service after which Cain's frontend can be used to remotely control the machine.

Brief Overview:

This post will cover the first two aspects of Cain only. Please note that this tool is available for Windows only. It uses the Winpcap (a port of libpcap) library to inject and monitor packets at link layer.

1. Install Cain (link)and run a quick Arp scan to find out all the local machines within your network.

2. Now start a man in the middle attack between two victim nodes. Obviously the best strategy is to attack a victim PC and your gateway router. This will allow you to read or sniff all the data between your victim PC and the outside world which is the requirement in most of the cases.

Options and Basic Configuration:

To configure which protocols/ports to sniff and route through your machine, go to configure->filter and ports and then tick all the protocols. Nowadays modern browser display a warning when the connection is under MitM. I would suggest that you uncheck port 443 which denotes ssl/https traffic. There are other interesting ways to decipher ssl traffic.

The other important tab to go is the HTTP Fields tab. It defines which keywords to grab and display the corresponding values. So if you are not able to capture username and/or password of a particular webpage, chances are that they use different value and name pair variables.

Finally the option which makes Cain and Abel worth using is the "Spoofed ip and mac option". It basically allows you to do all the above using some other IP from your subnet. So even if there is a MitM or sniffing detector, it will catch that imaginary IP that you have chosen. Simply go to ARP tab and choose a spoofed IP and MAC address. Make sure it is not in use by any other machine in your subnet.

Initiating the Attack:

Now that we are all set, click on the sniffer button as illustrated below. Click on the + button to ennumerate all the devices. Click on the button next to it and you will start poisoning the victims ARP table and thus perform the MitM attack. Once the whole process has started, the tabs at the bottom come in handy. According to me, the most important ones to look at is the APR tab and Passwords tab. They will in all likelihood contain all the details that you wanted to know, for which you started this whole process! Passwords found in all the major protocols- HTTP,HTTPS, FTP,RADIUS,SMB,SSH-1,Telnet to name a few!

Cain can process protocol specific traffic

Cain And Abel is one of the best sniffing tools around for several years now. It is easy to configure and quite stable. The only drawback is that it is Windows based tool.

Here is a short video exhibiting how powerful yet easy this tool is to use.

In the next part of this tutorial I will be describing how we can use open source tools to achieve the same. I will also explain how we can thwart such techniques. Till then, happy packet sniffing!

Important Links:

1.Cain and Abel homepage
2. Uses of Abel
3. Promiscuous mode

Sniffing & man-in-the-middle/mitm using network sniffers

A long time ago I had written an article (http://anadisays.blogspot.in/2010/06/wireshark-as-sniffer.html) on network sniffers, primarily wireshark, which described what sniffing is and how one can passively sniff other users' data by setting Wireshark in promiscuous mode. Such a technique is known as passive sniffing and is really useful if your local network uses hubs instead of switches. But if your network uses the latter then you will not be able to capture all the traffic. The difference is due to the way these devices forward packets to the destination.

When a node sends a packet to a hub it quickly makes several copies and forwards it to all the other physical ports. The figure below illustrates this.

As you can see, the network packet denoted by the envelope is supposed to be delivered to PC0. But as soon as it receives the packet from Router0 it makes several copies and pushes it through all the links.

So if PC1 were to be running Wireshark then it will always receive all the traffic meant for PC0. It should be clear that it becomes very simple to sniff data when using hub.

Now let us consider a network using a switch.

 In the previous article mentioned above I have explained how a switch maintains a table which has MAC address and physical port mapping.

Briefly speaking, any packet meant for PC0 will be forwarded only to that particular link and the other links will never get a copy. It is obvious that Wireshark running on PC1 will not be able to capture any other data.

Now comes the interesting part! A technique known as Active sniffing is all you need to overcome this problem! It requires you to perform a Man in the Middle attack aka MitM which will be described below. But before I delve into what is active sniffing and mitm let me talk a little about ARP and ARP spoofing.

ARP 

(NOTE: You may skip this section if you are well aware of what ARP is)

I assume you are already a little familiar with ARP (Address Resolution Protocol ). It is basically a protocol designed to allow two machines to communicate. It works at the link layer of the OSI model. You should also be aware of the arp or MAC table. It can be viewed by running the arp -a command in Windows and a simple arp command in Linux. It is a mapping of the IP address of a machine and its MAC address present in the local network.

Very briefly, if a node wants to send a packet it uses the destination IP address to look up its arp table to find the MAC address of that machine. When the packet is processed by a receiving node, it validates whether the destination MAC address matches or not, otherwise the packet is discarded.

ARP Spoofing/Poisoning

What if an attacker machine is somehow able to convince that it is actually the destination machine the victim wants to talk to? Simultaneously if it is able to convince the destination machine that it is actually the victim pc? Basically it will be able to read all their conversation.

Technically speaking, what if the attacking machine keeps on sending false ARP updates telling the victim pc that the destination pc's MAC address is its own?

Refer to the illustration above. Here the attacker PC has crafted and sent false ARP updates telling the victim PC to update its arp table to point the destination PC's arp table with bb:bb:bb:bb . The poor victim PC would always put the destination MAC address as bb:bb:bb:bb. The attacker after reading the packet will then quietly forward it to the destination using the correct MAC address. At the same time the attacker would attack the destination node as well.

Please keep in mind is that if the destination node is not in the local network then it will never be able to know its MAC address. This is because MAC addresses are not forwarded outside the local network.In such a situation you will have to attack the local gateway/router since all the traffic intended for outside the network is forwarded to it.

Finally even though physically the attacker may be anywhere within the local network, logically all data will travel through it. The attacker acts as a middle man between the victim and the destination PC, thus the term man in the middle attack.

To summarize, we achieved a man in the middle attack by ARP spoofing or ARP poisoning. This is active sniffing because unlike passive sniffing, where the attacker simply sits and silently reads all the packets, proactive measures are taken and network configuration or setting is stealthily disturbed.

Limitations of this attack

It should become clear that in order to perform this attack the victim PC and the attacker MUST be within the same local network. Also some protocols have been built to detect Mi-t-M attacks. HTTPS/SSL is one such protocol (I hope now you realize why it is advised to look for the small padlock when communicating sensitive information!). Most modern browsers will detect errors in digital certificates and promptly display an error. There are other techniques which have been developed to specifically attack SSL and HTTPS which will be dealt with in future.

Conclusion

Using these concepts, tools have been built which allow you to actively sniff packets. Such tools such as Wireshark combined with Arpspoof, Cain and Abel and Ettercap will be discussed in the next post of this series. By the next article you will be able to actively sniff and read data from packets intended for others! Prevention techniques will also be discussed.

IMPT: the next part of this tutorial *Actively network sniffing uing cain and abel*

Important Links:

1. Understanding passive sniffing
2. Wiki on arp spoofing
3. Wiki on Packet sniffing
4. Wiki on promiscuous mode

Wireshark as a network Sniffer or network analyzer

The last two posts(links at the end) on wireshark were about installation and using it for basic analysis and troubleshooting network traffic. This article explains why this software is so famous among hacker circles. Wireshark supports promiscuous mode which basically allows the host to view other hosts' traffic!

Detailed working of Wireshark

Nowadays Ethernet has emerged as the most widely used LAN data link and physical layer standard. To support hardware communication between many machines at the same time the concept of MAC addressing was introduced. When data is put on the cable for transmission all the other hosts receive that data and pass it to its NIC also known as the Ethernet card or LAN card. This data is then passed to its upper layer , the data link layer which checks whether the destination MAC /hardware address matches with its own (remember, MAC address of a machine is unique throughout the globe). If a match is found the packet is passed to the upper layer else the packet is discarded. Wireshark with the help of WinPcap library captures the frames from the interface (Ethernet, token ring networks are supported) regardless of the destintion MAC address therefore displaying packets meant for other hosts as well.

The only problem is that you might not capture any one's traffic if switched topology is being used instead of hubs. The reason lies in the way how switches and hubs propagate packets to end systems.

When a hub receives a packet on its physical interface is pushes out that packet through all of its other port. Consider this scenario

When the gateway sends a packet to the hub it forwards it to all its connected interfaces , as shown above.

Now consider a scenario in which a switch is being used instead of a hub

A switch silently learns the mac address of the end system and maps it to the physical port to which it is connected to. Therefore when a switch receives a packet it checks the destination MAC address and searches its table. If there is match, it forwards that packet through that particular port else floods it through all of the connected ports. It is clear that after a switch has built its table the packets are forwarded to the correct destination and the other connected hosts do not receive that packet. Therefore if Wireshark is run in a switched environment you will rarely be able to capture other's data. You might receive other hosts' data but that happens only when the switch has not completely built its table.

Here is an example of a switch's table where fa represents fastEthernet ports.

Finally, I tried to access my router's webpage through VMware XP running in bridged connection mode ( in bridging mode all the virtual pc's data is forwarded to the real machine which starts acting as a bridge) and ran Wireshark on my PC. Upon filtering data here is some juicy info

The authorization process has been captured by Wireshark; 'basic' implies that a very weak Base64 encoding has been applied. Decoding the string is very easy and can be done online , one such is link is provided at the bottom. The example above decodes to nando:nando which means a username and password of nando was entered.

Detection

Detecting this activity in a hub environment is nearly impossible and although a few tests can be done they are meant for older Windows versions ( 98,NT) and Linux kernels, therefore it is recommended that network administrators should implement switches as they not only provide security but also better network performance. Users should use encryption during important data communication.

NOTE
If you are not able to see others traffic make sure the promiscuous mode is set. Go to Capture->options , set the correct interface and tick the "capture in promiscuous mode field".

Also Windows users should ensure that npf be up and running, Linux users need to run wireshark with root privileges. If the problem persists then chances are that a switched network is being used.

To sniff a switched network a few more software and a deeper understanding of certain mechanisms is needed, which will be covered in some future article.

Wireshark has established itself as the leading packet sniffer software and a network analyzer. You can even use it to troubleshoot any DdoS attacks or malicious packets in your LAN. More on it in a future article.

Wireshark Installation
Configuring and using various options
Download Wireshark
Wireshark manual
Online Base64 encoder/decoder

What is Wireshark? A network or packet sniffer, Part 2

In this previous post basic download and installation of wireshark was discussed in Windows and Linux based Ubuntu.Today's article will cover the basic uses of wireshark, how one can use it to its maximum potential using various filters and other options. 
When you have configured wireshark to capture packets from the correct interface it will aptly show the frames being received and sent on that particular interface. You might get an output such as this ->

You can view the packet details by clicking on a packet. The details are displayed just like it is seen ie in the logically encapsulated form. So the ethernet frame would appear first then the ip header and so on.


Please note that Wireshark cannot capture wireless data and a special hardware (like a wireless usb adapter) is required to capture the wireless data.Cace Technologies have developed such a product called airPcap, links are at the bottom.
 

WIRESHARK FILTERS:

If you wish to see packets of a particular protocol , ip address or a port number and/or a variety of other parameters you can prepare a 'filter' ie a set of commands which would filter and display only the requested traffic.


Programmers especially C/C++ users will find it pretty easy to create filters because of the similarity in the syntax.
For example, if only TCP traffic is to be displayed simply enter tcp in the filter field and click on apply. If TCP is not required while all other protocols are append a ! before TCP. Almost all the major protocols are supported, atleast the upper layer protocols.


What if traffic from a particular ip address is required? Simply use the command ip.src or ip.dst command
Eg if traffic coming from 192.168.32.1 is to be filtered and displayed, then enter
ip.src==192.168.32.1 ; Note the use of two = signs

Suppose we want to view only tcp traffic coming from 192.168.32.1 ? Here we want two conditions to be satisfied simultaneously, therefore the && operator. The input to the filter field becomes


ip.src==192.168.32.1 && tcp


Furthermore, if we want to view tcp or udp traffic coming from 192.168.32.1 then we have a slight complex situation in which either the packet should be tcp and the source ip be 192.168.32.1 OR the protocol be udp and  source ip be 192.168.32.1, here the use of OR operatot ie || will also come to play. The filter will become:

ip.src==192.168.32.1 && (tcp || udp)

basically wireshark will check if ip.src is equal to 192.168.32.1 if true then it will further check if the protocol is tcp or udp if either comes out to be true the boolean output will be true and that particular packet will be displayed.


As a final example if we want tcp traffic with source port as 100 or 200 and destination port as 121 or 221 be displayed the filter will become:
ip.src==192.168.32.1 && tcp && ( tcp.srcport == 100 || tcp.port==200) && (tcp.dstport== 121 || tcp.dstport == 221 ) 

Follow a stream

One of the best features of Wireshark is the ability to "follow" a stream. When a TCP connection is established a two way virtual channel is created and the two end points then communicate. This feature displays the ongoing application layer data being exchanged in a strict chronological order. This can be very useful to analyze what kind of data is being exchanged at the application layer. 

Searching data

With the find packet option one can search for a particular string in the captured packets. The option is neatly tucked up in Find packet and string radio button.

Promiscuous mode

Another superb feature which made this software one of the most popular network analyzing tool and sniffer (earlier it was known as Ethereal). These two exciting topics deserve a proper explanation and a fresh page!


Download Wireshark
WinPcap Homepage
Airpcap Homepage

Analyze network packets using monitoring tool ie Wireshark

Anyone fascinated with computer network and how it has enabled connectivity between remote places throughout the globe must have wondered how it has been made possible. Small bytes of data continually flow through small wires, perhaps even without any wires and soon you have, Wikipedia displaying all the information known to mankind.








When you type www.google.com in your favourite browser, I assume it is Firefox :) , what sort of data is sent? How is it sent? If you want to watch the "data packets" in action what you need is a network analyzer or a network monitor aka sniffer. Network sniffing or packet sniffing is the same so don't be confused if there are other tools to do packet sniffing, because Wireshark does it all.

For a developer this software is pretty handy since it captures live data and shows what kind of data is being sent.

Although sniffers have more useful/evil purposes,(some future article) this article will cover how we can use a software called "Wireshark" to analyze the network data being sent.

The software is available for both windows and unix. The great thing is that it is an open source software, yet is updated regularly. The download links are at the bottom.

If you will be using Windows simply download the setup and install it. Wireshark comes bundled with WinPcap a set of libraries which allows Wireshark to capture packet in real time. During installation their will a prompt suggesting you

"Start WinPcap service "NPF" at startup -"

Allowing npf at startup would enable users without admin privileges to run it.If this bugs you then simply 'untick' the option and install it. The latter option however requires the user to start the NPF service manually by typing the following command in command prompt having admin priviliges each time before running Wireshark

net start npf

The following command stops the service

net stop npf

Ubuntu users need to type in wireshark in the synaptic software manager and let it do the rest. Other linux/unix users need to refer to the official documentation provided on their website. Linux users need to run wireshark as root privileges.


To capture live packets either click on the network interface that you want Wireshark to hook on to or if you're unsure which interface is being used go to options and click on interface. It will open a small windows displaying the number of packets received on each interface. The one having highest number of packets is most probably going to be connected to your local Lan or directly to the internet.


After you have selected the correct interface Wireshark will start displaying all the packets that are being sent or received by your computer.

This was a very basic lowdown on Wireshark perhaps one of the best networking tool.The next article of this series will cover some of its features.