Ettercap

Ettercap is Software tool For Man in the Middle Attack on Local Area Network.

1. Ettercap

2. What is Ettercap? Ettercap  is a free and open source network security tool for  man-in-the-middle attacks  on LAN.

3. First Download Ettercap from https://apps.ubuntu.com/cat/applications/precise/ettercap-graphical/

4. Then Open Gui Module Via Write “Ettercap -G” in terminal

5. Select Network Interface The next step is host scanning. Click the “Hosts” menu and then click “Scan for hosts”. When the scan is finished, click the “Hosts” menu and then click on “Host List”: Start sniffing

6. Click on MITM Menu Select Arp poisoning

7. Man-in-the Middle MITM is named for a ball game where two people play catch while a third person in the middle attempts to intercept the ball.

8. Man-in-the Middle(Continued) A man-in-the-middle (MITM) attack is a form of eavesdropping where communication between two users is monitored and modified by an unauthorized party.

9. So, Which MITM attack Ettercap Provide Arp Poisoning DNS spoofing DHCP spoofing

10. Arp Poisoning: What is ARP? Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address that is recognized in the local network. 

11. How ARP Works? When an incoming packet destined for a host machine on a particular local area network arrives at a gateway, the gateway asks the ARP program to find a physical host or MAC address that matches the IP address. The ARP program looks in the ARP cache and, if it finds the address, provides it so that the packet can be converted to the right packet length and format and sent to the machine. If no entry is found for the IP address, ARP broadcasts a request packet in if one machine knows that it has that IP address associated with it. A machine that recognizes the IP address as its own returns a reply so indicating. ARP updates the ARP cache for future reference and then sends the packet to the MAC address that replied.

12. What is Arp Cache? A ARP cache is a temporary database, maintained by a computer's operating system and in switch, that contains records of all the recent attempted visits Arp Request and their Resolver.

13. Then What is Arp poisning ? Address Resolution Protocol poisoning (ARP poisoning) is a form of attack in which an attacker changes the Media Access Control (MAC) address and attacks an Ethernet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets. By This all the packets Are received by Attackers MAC and it Can violate Confidentiality,integrity .

14. Arp Poisoning Be Like

15. DNS SPOOFING: What we know About DNS? The  Domain Name System (DNS)  translates Internet domain names to IP addresses.

16. How DNS Works?

17. What is DNS Cache? A DNS cache (sometimes called a DNS  resolver  cache) is a temporary database, maintained by a computer's operating system, that contains records of all the recent visits and attempted visits to websites and other internet domains.

18. Example of DNS cache docs.google.com ------------------------------------- Record Name . . . . . : docs.google.com Record Type . . . . . : 1 Time To Live . . . . : 21 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : 172.217.6.174

19. DNS Spoofing DNS spoofing , also referred to as  DNS cache poisoning , is a form of computer security hacking in which corrupt Domain Name System data is introduced into the DNS resolver's cache, causing the name server to return an incorrect IP address. This results in traffic being diverted to the attacker's computer (or any other computer).

20. Example Suppose Victim wants to open facebook.com So He Writes facebook.com in the Browser URL. Then DNS Resolver Finds facebook.com from DNS cache. Victim’s Resolver Found attacker’s ip and DNS Resolver Redirects that ip and then unfortunately Victim is attacked by spoofed dns .

21. Thank You Present By Prem Thakkar Website : http://www.premthakkar.tk Contact:- [email protected]