Hello and welcome to this lecture in this lecture we're going to talk about a new tool which is so widespread.
It is a very important tool in order to analyze the packet that is sent or received from sorting missing.
So in this case you could see.
Let me just open that site and let's get what is was sucked into the little so let's see wires.
So this is the application.
You can simply source it and you can open that application.
It is some random masses just ignore it.
And up to that you could see the welcome masses and below that you can see the interfaces is here.
So you could see the lens through these my interfaces there is it your zero is it doesn't have any traffic
but in the n0 it really doing some traffic let's go over here in here.
Let's open the Firefox and I'll just say YouTube and let's see if there is some backers.
So.
OK.
Let's go back to the Web site and you see.
There will be some spikes.
So there will be more generated spikes when there's a saw that these Internet in this skull next missing.
So next thing what you need to do in order to analyze that packet is simply press on this capsule button
and it will so use some of these information related to the packet that you send or receive on this
column missing so you could clearly see there was a request for the YouTube and you could see all the
packages are TCB and some other airport packages and these are the way to just grab that packet information
and save it and you can also reference it for the later purpose.
So this is the one way you could clearly see we got so much of information with the help of wires out
but you could see this is going to give us nothing information about the client.
So if you see clearly over here it is only the information about the clearly next month.
We are not surfing this YouTube dot com in the window.
We are just surfing that in this college Linux.
So that is not a hacking tool obviously because it is not going to give us any information until you
use man in the middle framework.
Because if we just remember what the man in the middle does is basically it helps to just intercept
between the package that is sent from the router to the client basically will be is interceptor or will
be in the middle of the package that descend from the client to the outer and from outer to decline.
So we'll just get that packaged responses and the request and we'll just capture that with the wires
out.
So why risk alone is not a hacking tool.
Just remember that with the help of man in the middle in a wire side it is a very powerful tool for
the hacking purposes.
And we'll see the action in a minute now and before that could see how do the scraps of the package.
You can also filter this package if you want to see.
Yes the TV package you can do from here which is just type here the package you want to serve and the
set into it is going to give us the package that you want to see.
So this is the way to use wire.
Now let's see how wires suck in the man in the middle work together.
So first of all what you need to do is let me disclose this wire sack for now and let's open our terminal.
So now until now you should know that how to use this man in the middle framework and the command is
very much easy.
So all you need to do is just put a gateway in these Gateway and the gateway is 1 9 2 1 6 a dot 1 dot
one.
It is for my double land zero interface.
You can also use it to 0 0 but makes you the gateway in the towers it is written properly.
So the target here will be mine.
This must which is when the missing and IP addresses is right here.
If you want to grab the IP addresses IP config and you will just get these IP addresses of dismissing.
So it is 1 9 2 1 6 8 dot wandered 14.
And after that you will simply write the interface which is w land zero which is our interface.
So now we have again the problem because I this was something here.
So this go and remove this one.
It made into.
Now our men in the middle framework ease online.
So let's go over here and solve for something.
So I say disappears without Bill in the way wave dot com and let's solve this one and go back here.
Then you could clearly see we are being capturing these Web sites and this is done by the man in the
middle.
And now what we did was we are in the man in the middle basically we had inside the galley lined the
in and basically now every package that is sent from the outer to the client which is window is sent
from us.
So now we can open the wire side and see every package that is sent from these client to the router
or from router to the client.
So I'll just say why Sark as open these wires are now you'll see that although I'm not using any internet
in here you could clearly see I have not opened up Firefox in this column missing.
There will be spikes because this is because of this machine which is of this machine so let me just
press into one more time.
It is suing the bad gateway.
So let's press one more time and you could see again we have this disappears review and again that is
running and you could see these spikes away.
So this is the traffic generated by this machine but not by color Linux.
So let's sit on it one more time because it is not working properly
maybe the Web site is down so that can be the case
let me run the five folks.
One more time.
Let's see if this works or not.
And we'll just skip to the packet from here.
So now all I want to open is test Piers reveal and wiped out com
so after a couple of try I just found that the website was down for some time and you could see it is
still not running so what I just decided is to with this same website.
But in this case it is to test for a couple of things over here.
It is the same Web site that is made by test BSB but in this case it is made for the vulnerability scanner
for the python and that.
Was a list straight in this website with the same website over here.
So let's close this.
And now if you want to try this first of all you have to make the man in the middle.
So this is the same command that we are using from previous lecture is basically the man in the middle
framework.
Let's run this first and let's see if we can get again that these the S's endless if this displays let's
go back here and you could clearly see again we have these so much of information that is thus giving
us both these traffic.
So this close this Web site and over here in the windows we have this feel and you can also see about
the contact about base and you can go to the contact and if I say something like this gene and if I
just suspend then it is going to give us the information.
Thank you very much.
Send something like that and you could see.
Now I have seen here the first name is such and so you could say this is a post method which means we
are just sending data to the server and it will just get traffic.
But if you just go in the wires are.
This is important because now we are a man in the middle.
That means we get the information of the traffic right here.
Even if we are not using Internet on the Linux it is going to give us the traffic right here because
now we are men in the middle.
That means you'll see there will be some traffic generated right here.
But if I don't use this must seen analysts go back here and if I want to use this machine and if I just
close this.
This is not going to give any traffic because either of these must in either color Linux or Windows
swords sort of in order to trip that packet.
So if we are not the man in the middle that means the packet which is sent from the column Linux or
which is received by the car Linux will be only analyzed by wires out.
But now where man in the middle that means we can now analyze the packet that is sent and received by
the client which is our window machine over here.
So let's see how this works.
So first of all we are now men in the middle.
So first of all you have to be man in the middle.
And after that will this now capture the packet.
You start capturing the packet and it will just start here.
You could see all the information about the packet.
So next thing is I'll just go to the window and let's go to this contact base and here I want to give
some information.
Let's say I want to give those same as instead of sitting I'll just give you another name.
I'll just say you then me and last name is also you then me and e-mail addresses you to me edit it you
then me dot com and less to some subject.
It is such as an endless send this and now it to this.
Give us some message.
Let's see if we just grab that information.
So here you could see so much of packets.
And if you want to filter that packet you have a small field.
And if I say yes to deep packet sort of filter let me heat enter and first of all you have to be stopped
now because we have a lady guard maybe the traffic that is going to source the information about this
responses and let's stop now capturing the packet.
And I have now yes duty bill over here all the information and you could see it right to this yes city.
We have this land and we have this info.
So we then for you have this get method and you have also disposed matter so get method is basically
getting the papers to render in post is basically the information that is very critical because this
is where you have the password or email that is sent to by the user to the server.
So you could see clearly we have also the get method.
We have also the post method.
So first of all let me see this.
Get method and let's go here and inside these this to TB protocol.
You will see the request that is made by the user.
And you could see all the information.
So this information is not that critical information.
You could see this information over here.
This is yesterday information and you could see there is line based text file in every information.
And this is also not the critical information because the critical information will be about the client.
So if I just say go maybe this supposed method.
Now inside this sports post Mr. you'll have this form and the lists uh make this bigger and let's see
what we can have here.
So you'll see clearly that we have this field which is saying hypertext transport protocol which refers
for ESTA DP.
Now let's go inside and we'll have this post and let's see what we have next.
So let's open this post and you'll see that the information about the land and everything.
So this is also not the critical information but if I just go down here and it will see SDM will farm
you are in court a less open D and you are going to get all the information over here so you could see
the first name you they meet.
And the last name is also you they mean the address was sent as you to me that they do re mi dot com
and the subject was sedition and the message was empty which was what we just sent from our D support
site.
So we just cracked what was sent by the client to the server.
So you can also correct something that is said password with the help of these wires are all you need
to do is add some plugin annual just get to go with that technique so you could see how easy it is to
analyze the packet with the help of man in the middle and the wire side.
So basically we have to be first of all man in the middle.
Otherwise it is going to just give us the information about the packet that is sent in received by only
that Linux.
So after being man in the middle it just kept to that packet.
You will just see the responses.
Use this filter it and you will see these forms.
So in this case we have these forms right here.
So we get all the information that was sent by this window machine which is from this Firefox to this
Web site.
And we saw what was the feel that was installed by the client so you could do multiple is with the wires
OK and this would be enough for this Alexa soon the next.