CEH_v9_Bettercap : MITM attack for sniffing traffic and passwords
- Sniffing Traffic
- Getting password
apt-get install bettercap
The above three commands will leave you with latest versions of Kali and bettercap.
PS: I am writing this tutorial from a location with slow internet connection, and hence didn’t perform the dist-upgrade step. However, bettercap seems to be running mostly fine. There may be a few difference in what you observe and what I show in this demo due to this difference in versions. For those who want to know the versions of various utilities that I’m using, take a look below. If you are unfamiliar with Linux, you’re best off using the latest versions of everything, which can be obtained by running the three commands I mentioned earlier.
new@kali:~$ uname -a
Linux kali 4.7.0-kali1-amd64 #1 SMP Debian 4.7.6-1kali1 (2016-10-17) x86_64 GNU/Linux
Not on Kali?
|Sniffing traffic: Screenshot shows my lenovo smartphone’s
requests to truecaller being sniffed
You’ll see all the websites being visited by all the devices on the network. Press ctrl+c to stop.
Take a look at the help manual for more commands, or read the wonderful documentation.
Internet stopped working
- Run the command bettercap on the terminal
- Wait for bettercap to acquire targets.
- When bettercap discovers the target you’re looking for, note down it’s IP address. Let’s call it TARGET_IP.
- Press ctrl+c to stop bettercap (if internet connectivity is lost, as was in my case, restart your wlan0 interface)
- Run this command – bettercap -T TARGET_IP –proxy -P POST (replace TARGET_IP with the appropriate IP)
|In my case, my target was my Lenovo smartphone. It was detected by bettercap,
and i noted down it’s IP. 188.8.131.52 is what I’ll use as my TARGET_IP
Now your attacker machine is ready and listening for traffic on the network. Once your victim opens any login page, bettercap will use sslstrip to remove the https from the URL, and once the target enters his/her login credentials, you will see them in cleartext.
Capturing passwords entered on Outlook by smartphone user on same LAN/WLAN
|Starting bettercap using the command I specified earlier.
Then I proceed to open outlook.com on my smartphone
|SSLStrip detects that I’m trying to access outlook, removes the https from the page|
|This is the login page that my smartphone sees. Notice the address in the URL.|
|This is what the address should look like, with HTTPS. The URL on the smartphone lacks
HTTPS, and has extra Ws in www. I enter the username here. Meanwhile,
bettercap detected that username was entered and shows that to me.
|Bettercap shows me the username. In the smartphone, I am at the password stage after entering username.|
|I now enter the password. Let’s see what happens on the attacker machine|
|I entered the password as “wrongpass” on my smartphone, and
bettercap is able to detect it.
- The biggest problem – It does not work on all sites. Before trying outlook, I tried to see if I could carry out this MITM attack over Facebook, Gmail, Twitter, etc. Unfortunately, I wasn’t able to. It only seems to work with some websites.
- The difference in the URL if easily visible. Anyone who knows what https is, will notice the lack of it. I, for one, would never enter my credentials on an http page.The extra Ws in the www don’t help eitheir.
- The tool isn’t perfect. There are a few bugs.
|Facebook seems immune to the attack|
|Yahoo’s response is buggy, but you’ll notice
that sslstrip did it’s job, the page is regular http now
How to be safe
Here are some pointers-
- Never enter your credentials on a non-https page. Also, if there’s some flaw with the https, your browser usually will point that out to you.
- Be extra careful on public wireless networks.
|By clicking on details, you can see exactly how your connection to
a website is encrypted.
|Chrome provides detailed breakdown of the cipher used and the validity of certificate|
Things to do
- Try other functionalities offered by this tool.
Try to get it to work with Facebook and Gmail.I’ll have to approach facebook and Gmail in a different manner, read the comment by Giorgio below for more information.