MitM Attack using Bettercap.

Man in the middle attack

       

          Man-in-the-Middle Attack generally abbreviated as MitM, In computer security a man-in-the-middle attack   is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. One example of man-in-the-middle attacks is active eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

          As show in the above diagram Suppose user wishes to communicate some other device or person via internate Meanwhile, Attacker wishes to intercept the conversation to eavesdrop and optionally to deliver a false message between them.

bettercap

          BetterCAP is a powerful, flexible and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in realtime, sniff for credentials and much more.

   

Installation

          First we need to install the rubygems dependency to run BetterCAP, enter following command to install dependency from gem, if you already install that then skip it.

sudo apt-get install build-essential ruby-dev libpcap-dev

After that install the BetterCAP using the following command

 sudo apt-get install bettercap

 If you have trouble to install BetterCAP using above command then try

 gem install bettercap

 Mitm using BetterCAP

Now get started bettercap with type "bettercap -h" it will show various options and operations available in bettercap.

 -T                       : Specify MitM target
 -I                        : Interface to use
 -G                      : Specify gateway address
 --ignore              : ignore specified addresses
 -X                       : enable sniffer mode
 -S                       : spoof using ARP, ICMP, NONE
 --kill                   : kill connection for any target
 --log                   : log the output to someware
 --log-timestamp : add a timestamp to the log     

It will provide many options you can find by typing

bettercap -h

 

Sniffing Traffic
  
Sniffing mode bettercap capture all the details of user and its activity like creditcard data, Cleartext passwords over HTTP, FTP, POP, IMAP, SMTP, Cookies, database connection, URLs, etc

you can enable sniffing mode in bettercap using following command....

bettercap -X -T<victim's ip> 

          Using bettercap we can analyze the traffic of entire network and find suspicious activity in the network. here following screenshots that shows that which information sniff by bettercap.

The above figure shows the cookies captured by the battercap.

The image shows the list of creditcard data means creditcard numbers which is highlighted.

 it will also capable to capture request header and request body it will also show in figure.

the above image shows the information about the device like device name, its ip address, connection type, language, device model, operating system, operating system version, mac address and other important details.

          We can also save the traffic into the log file for the future process use with timestamp, using --log-timestamp append this command with sniffing or other command for example

 bettercap -X -T192.168.0.101 --log-timestamp sniff

Sniffing & Credentials Harvesting

The builtin sniffer is currently able to dissect and print from the network the following information:

• URLs being visited.
• HTTPS hosts being visited.
• HTTP POSTed data.
• HTTP Basic and Digest authentications.
• HTTP Cookies.
• FTP credentials.
• IRC credentials.
• POP, IMAP and SMTP credentials.
• NTLMv1/v2 ( HTTP, SMB, LDAP, etc ) credentials.
• DICT Protocol credentials.
• MPD Credentials.
• NNTP Credentials.
• DHCP messages and authentication.
• REDIS login credentials.
• RLOGIN credentials.
• SNPP credentials.
• And more!

 

Servers

          Bettercap also provides the inbuilt servers like HTTP & DNS it allow you to serve custom contents from your own machine without installing and configuring other softwares such as Apache, nginx or lighttpd.

 

Proxy

           Bettercap is shipped with a HTTP/HTTPS  and raw TCP transparent proxies that you can use to manipulate HTTP/HTTPS or low level TCP traffic at runtime, for instance you could use the HTTP/HTTPS proxy to inject javascripts into the targets visited pages.

          Once one or more proxies are enabled, bettercap will take care of the spoofing and the firewall rules needed in order to redirect your targets’ traffic to the proxy itself. It will Provides proxy for TCP, HTTP, HTTPS, and SSLSTRIP.

          By default the builtin proxies won’t do anything but logging all the requests, additionally you can specify a “module” to use and you will be able to load one of the builtin plugins and manipulate all the traffic as you like.

LEGAL DECLAIMER

If you do not fully understand something on this material, then go outside of here! refer to the laws in your province/country before accessing, using, or in any other way utilizing these material.

These material are for only educational and research purpose only. we are not responsible for any kind of misuse of this material.

 

If you Like This Please Share With Your Friends!