Time
1 hour 18 minutes
Difficulty
Intermediate
CEU/CPE
2

Video Transcription

00:00
Hello and welcome back to the course. My name is Dan Hiccup Radius. And in today's video, what I'm gonna be exemplifying is through the Cali Lennix machine and also the Windows machine. How to go ahead and set up not only a man in the middle attack, but also how to do a session hijacking. So before I go ahead and start this, I wantto exemplify that through your virtual machines,
00:19
you're gonna have to go through the preferences
00:21
and from the preferences aspect. You want to make sure that your network address translation has in that network so that both your target and your client machine has two separate I p s, which is necessary on that network
00:36
that's on Windows and same thing on Callie, that network.
00:41
So now we're gonna do is we're gonna log in through Windows session Hijacking is the user password recession.
00:47
We want to first go ahead and start up. Excellent.
00:51
And from here, start up our Apache server so we can run the d v w ay as well as my SQL.
00:58
Let's move this suicide now at the same point, we want also run in windows, the command prompt and see what our I P is i p config enter
01:07
and in the Cali Lynette's machine. We also want to see that we do have a separate i p. Which is I f config enter.
01:12
So here we have 10.0 that 2.5
01:15
on the telly machine.
01:18
And I'm going back to the windows machine is $10.0 to 15 with a gateway.
01:23
Now, you want to start up our men in the middle attack?
01:26
So what type of AARP? Smooth
01:29
interfaces e th zero.
01:32
And the target is the I p of the Windows machine, which is 10.0 that tooth out 15.
01:40
And then, of course, we have to put in our gateway,
01:42
which is 10.0 that to that one. I'll move this over,
01:47
but a space
01:49
press enter. Make sure it works. Okay, Now the same time you want to do this in reverse order.
01:57
So there were capturing packets
01:59
both to and from machines. The ARP spoofing
02:01
interface, E t zero.
02:04
Now, the target this time is the gateway. 1st 10 that zero that to that one
02:08
with the I p of 10. That zero to about 15
02:15
now we have a really is going
02:23
now I'm gonna open up. Who will Chrome?
02:27
No. Before I going to do anything, I want to go through Callie and I want to open up the tool that's called wire shop
02:32
wire. Shark is very, very interesting. And how it
02:37
captures the packets.
02:38
So don't worry about this message here. That's fine. What I'm gonna do right now on the windows and machine is go through the actual Devi a location.
02:47
So now what I'm gonna do is start capturing my packets on Lennox.
02:52
We see our source,
02:53
and what I want to do is type in admin
02:57
and the password is password. Log in.
03:00
Now, what I want to do is I want to go down to D V W security
03:04
and change it from impossible to low click on submit.
03:09
And at the same time, I want to go through and click on more tools.
03:14
Click on developer tools.
03:15
Here you go. Here's the session. I d
03:17
as well as a security level.
03:21
So now let's go ahead and analyzing the next video. Exactly what we've captured
03:24
through wires are
03:27
Thank you. Look forward to seeing you in the next video.

Up Next

Session Hijacking

This course covers session hijacking, which is where an attacker takes over a legitimately established session between a user and host. This is normally seen between a user and a Web server, but it could occur with a Telnet session or other TCP-based connection.

Instructed By

Instructor Profile Image
Ken Underhill
Master Instructor at Cybrary
Master Instructor
Instructor Profile Image
Dave Kupratis
Instructor