Do you think youâ€™re safe if you type https :// before paypal.com? I hope youâ€™ll think twice before you login from a computer connected to a wireless network after reading this guide. Letâ€™s start at the beginning. Letâ€™s say you have an evil neighbour who wants your paypal credentials. He buys himself a nice laptop with a wireless card and, if you are using a wep encryption, he cracks your wep code (click here to see how). After cracking the key he logs into your network. Maybe you always allowed him to use your network because you thought it canâ€™t do any harm to your computer. You arenâ€™t sharing any folders so whatâ€™s the problem? Well, in the next few steps Iâ€™m going to describe the problem.
1. Letâ€™s assume your neighbour uses linux to crack your wep key. After cracking it, he installs ettercap (http://ettercap.sourceforge.net/) on his linux system. If you want to do this at home, I would recommend you to download BackTrack because it already has everything installed. Look at the WEP cracking guide I mentioned above for more info about BackTrack. If you want to install it on your own linux distribution, download the source and install it with the following commands:
$ tar -xzvf ettercap-version.tar.gz
$ make install
2. After installing, you need to uncomment some code to enable SSL dissection. Open up a terminal window and type â€œnano /usr/local/etc/etter.confâ€, without the quotes. Scroll down using your arrow keys until you find this piece of code:
# if you use iptables:
# redir_command_on = â€œiptables -t nat -A PREROUTING -i %iface -p tcp â€“dport %port -j REDIRECT â€“to-port %rportâ€
# redir_command_off = â€œiptables -t nat -D PREROUTING -i %iface -p tcp â€“dport %port -j REDIRECT â€“to-port %rportâ€
You need to uncomment the last two lines.
# if you use iptables:
redir_command_on = â€œiptables -t nat -A PREROUTING -i %iface -p tcp â€“dport %port -j REDIRECT â€“to-port %rportâ€
redir_command_off = â€œiptables -t nat -D PREROUTING -i %iface -p tcp â€“dport %port -j REDIRECT â€“to-port %rportâ€
3. Press CTRL+O, press enter to safe the file and then press CTRL+X.
4. Boot Ettercap and click on Sniff > Unified Sniffing > type in your wireless interface and press ok.
5. Press CTRL+S to scan for hosts
6. Go to MITM > ARP poisoning, select sniff remote connections and press ok.
7. Now you (and your neighbour!) can start sniffing! Press start > start sniffing. Walk to another computer on your network and open up paypal or any other site where you need to type in an username/password (gmail, hotmail, digg.com, etc.). All credentials will appear on the computer running Ettercap!
8. When youâ€™re done, donâ€™t just close Ettercap, but go to Start > Stop Sniffing, and then go to MITM > Stop mitm attack(s).
But how does all this stuff work?
Look at the following scheme:
Normally when you type in a password, host 1 (your computer) directly connects to host 2 (your modem or router). But if someone launced Ettercap on your network, host 1 isnâ€™t sending itâ€™s passwords to host 2, but to the Attacking host, the host thatâ€™s running Ettercap! The attacking host sends everything to Host 2. This means that host 1 isnâ€™t noticing anything! Exactly the same happens with everything that host 2 is sending. Host 2 doesnâ€™t send packets directly to host 1, but forst to the attacking host.