A good hacker is an expert. Being under the radar enables him to remain undetected By pretending to be a network administrator. He uses it to make a hacker do this method of cheating or disguise.
Spoofing
As you have read in the previous chapter, deception is the use of deception techniques by hackers Mimic or pretend to be another person, organization, software, or website. This is the same as Intent to bypass the target’s security protocol to access the target’s information
Hackers want it. Here are some of the most common deception techniques used by hackers:
1. IP spoofing
This technique is to mask the IP address of the computer that the hacker is using in order to To trick the network into thinking that a legitimate user is communicating with the target computer. arrive In doing so, hackers will imitate another IP address or range to satisfy the Network administrator.
This spoofing hacker technique works by looking up the IP addresses used by trusted hosts. After finishing Therefore, you can modify the header of the packet to trick the network into believing it is From an authorized user. This way, you can send harmful packets to the target network, None of them have been traced back to you.
2. DNS Spoofing
DNS spoofing works by using the IP address of a website to send someone to a malicious A website where hackers can easily obtain private information or user credentials. This man-in-the-middle attack (MITM) allows you to communicate with an unsuspecting target, thus thinking that he has Enter the website he searched, and let the hacker receive account details for free The user will enter a fake website.
To make it work, the hacker needs to be on the same local area network as the target. in order to achieve To access that LAN, hackers can simply search for a weak password on a machine Connecting to this network can even be done remotely. Once successfully completed, a
Hackers can redirect users to the manipulated website and monitor all their activities there.
3. Email Spoofing
Email spoofing is very useful when bypassing security services used in email services. This means that when an email address is spoofed, the email service will identify any Mail sent from the manipulated account is legitimate and will not be transferred to the spam inbox. this
Technology allows hackers to send emails with malicious attachments to specific targets.
4. Phone number spoofing
Phone number spoofing usually uses false area codes or phone numbers to cover-up The location or identity of the hacker. This strategy allows hackers to successfully eavesdrop on voicemail messages Their target, use a spoofed number to send text messages or mislead the target From-all these strategies are very effective in laying the foundation for social Engineering attack.
The danger of camouflage or deception attacks is that they are not easily detected by most people Network administrator. The worst part is the network administrator and the security protocol installed Allow malicious users to interact with other users through the network, and even manipulate, stop or inject The data stream enters the target system. Because hackers who can penetrate the network can easily set up
Purchase from one of the mainframes or controlled devices in the system, it is easy for him to manually operate Attack in the middle. (MITM)
Man-in-the-Middle Attacks
Man-in-the-middle attacks become a very smart follow-up to criminal hackers Successfully executed a spoofing attack. Although some passive hackers will be satisfied with only being able to In order to view the data he needs and avoid being manipulated while listening to vulnerable hosts, some people may want Execute the active attack immediately after being able to successfully launch the spoofing attack.
When hackers perform ARP spoofing, they can perform a man-in-the-middle attack, which is caused by Send fake Address Resolution Protocol or ARP messages through the infiltrated LAN. when Successfully pull off, the forged ARP message allows the hacker's MAC address to be successfully linked To the IP address of the legal user or the entire server in the target network. Once the hacker can
Link his MAC address to a legal IP address, and the hacker will be able to receive all data from other users Send it over the network to the IP address he is using. Since he can already access all the data The hacked user (owner of the IP address) enters the information he received through the network, Hackers can choose to perform the following actions during an ARP spoofing session:
1. Session hijacking-this allows hackers to use deceptive ARP
Steal the user’s session ID and use these credentials to access later
account.
2. Denial of service attack-this kind of attack can be used in ARP Spoofing is to link multiple IP addresses to the MAC address of the target device. what What happens in this type of attack is that all data that should be sent to other IP addresses is Instead, it is redirected to a single device, which may cause data overload. You will know more The content of DoS attacks will be introduced in later chapters.
3. Man-in-the-middle attack-hackers pretend not to exist A network and then intercept or modify messages sent between two or more victim.
Here is how hackers use tools for ARP spoofing to perform man-in-the-middle attacks Called Backtrack, a hacking toolkit similar to Kali Linux:
Step 1: Sniff out the data you need
This can be done by using Wireshark, sniff and tcpdump tools. By launching these tools, you can See all the traffic you can connect via wireless or wired networks.
Step 2: Use the wireless adapter and put it in monitor mode
When you put the wireless adapter or NIC in monitor mode, you will be able to pick up all The amount of traffic available for your connection, even those that do not fit your IP address. If you Connected to the hub network, you can get the required traffic without any difficulty.
However, if you plan to penetrate an exchange system, you may need to choose a different strategy. Because the switch adjusts the traffic and ensures that certain packets are sent to a certain MAC Address or IP address.
If you want to bypass the switch, or at least know what type of information is sent to other Users, you can try to change the entries in the CAM table that maps IP and MAC addresses Send messages to each other. If you change the entry, you can successfully get traffic
Intended for others. To do this, you need to perform an ARP spoofing attack.
Step 3: Fire up Backtrack
Once you are able to pull up Backtrack, pull up three terminals. Afterward, and do the following:
1. Replace the MAC address of the target client with your MAC address. Enter the following string to tell the client that your MAC address is the server: arpspoof [client IP] [server IP]
2. Reverse the order of the IP address in the previous string you entered used. This will tell the server that your computer is a client.
3. Now you are both the server and the client, you Now it needs to be able to receive data packets from the client and then forward them to
The server can also be reversed.
If you are using Linux, you can take advantage of its built-in ip_forward function, which can Enables you to forward received packets. Once you open it, you will be able to Use ipforwarding to forward packets by entering the following command in Backtrack:
Echo 1> /proc/sys/net/ipv4/ip_forward
After entering this command, your system will be placed in the middle of the two clients And server. This means you can now receive and forward clients and servers.
4. Use Dsniff to view traffic
Now that you can capture all incoming and outgoing client and server traffic, You will be able to find all available traffic. To do this, activate the sniffer tool on Backtrack By entering the command "dsniff". After doing this, you will see that dsniff is activated and
Listening for available traffic.
5. Get the credentials or data you need on ftp
Now, all you need to do is wait for the client to log in directly to the ftp server. When that When this happens, you will immediately see what his username or password is.
Since users and administrators use the same credentials on all services or computers In the system, you can log in using the credentials you can receive.
Comments
Post a Comment