Message from the author
Playing with traffic. Actually, it's more along the lines of "URL Manipulation"; however that didn't sound as "catchy". I do plan to do another video on "Altering (web) content", which would be more actuate in regards to "Playing With Traffic". This would be done using Squid (instead of using Ettercap) - and I've had some ideas for when I do this too!
This was posted on "April Fools" (The time for pranks and "gotchas") and what seems to be a (harmless) "prank" is still an attack. This means you need permission to do it (just like everything else on this site!) - as you may capture/discover more than you planned. Like always, make sure you have permission, and, due to the content of one of these attacks, you need to make sure you don't expose "minors". On that note: you're on your own. What you do, is your doing. What you make happen is your responsibility. You have been warned.
And with all of that out-of-the-way...
There is more to "Man in the Middle" attacks than just getting/collecting/harvesting emails/passwords/cookies. For example, the attacker could manipulate & alter the target's traffic to have some "malicious fun" (even though some scripts are "borderline childish"), to highlight the dangers of a "Man In The Middle" attack and what other abilities/options are available to the attacker. Below is a breakdown of the scripts demonstrated:
- asciiImages.pl ~ Converts images into ASCII art (www.msn.com)
- blurImages.pl ~ Makes images harder to see (www.flickr.com)
- flipImages.pl ~ Flips images vertical (www.google.com)
- flopImages.pl ~ Flips images vertically (www.google.com)
- googleSearch.pl ~ Modifies Google search queries (www.google.com)
- noInternet.pl ~ Replace every web site (www.bing.com)
- replaceImages.pl ~ Replace every image (www.ebay.com)
- replacePages.pl ~ Replace a selected site with ours (www.facebook.com)
- rickrollYoutube.pl ~ Redirect to a youtube video (www.twitter.com)
- timeMachine.pl ~ Uses archive.org archives (www.bbc.co.uk)
- touretteImages.pl ~ Add words to images (www.yahoo.com)
- fightClub.pl ~ Add images to images (www.imdb.com)
- allPornInternet.sh ~ Setup & "configure" dansguardian (www.google.com)
Watch video on-line:
*If you wish to view only the effects of the attack or know how to setup Squid from before, skip to 03:40 in the video*
- Nmap – Can be found in BackTrack 4-R2
- Squid – Can be found in the BackTrack repository
- Apache – Can be found in BackTrack 4-R2
- DansGuardian – Can be installed via
- ARPSpoof – Part of the DSniff suite which can be found in the BackTrack 4-R2
- A Text Editor – Katecan be found in BackTrack 4-R2
- The collection of scripts – See "Links"
- Start network services and obtain an IP address
- Download, install and configure Squid proxy
- Check the configurations and dependences for the script
- Set file & folder permissions
- Configure and perform a man in the middle attack
- Game Over
- Edit Squid configuration and restart service
- Game Over ...again
- Download & "configure" DansGuardian
- Restart Squid
- Game Over ...once more!
The attacker installs Squid3cache proxy via the Operating System (Backtrack 4 R2) repository. Squid is the "backbone" to this attack and after configuring it to work on the Local Area Network (LAN) and to be transparent(the proxy "works" without any configuration to the browser), the attacker chooses which script to first try out (asciiImages.pl is the first one) and adds it to the configuration file.
The attacker then opens the script up to verify its location as well as any requirements, which in this case is ImageMagick, Ghostscriptand jp2a. At the same time, the attacker checks the variables to match their local machine's configuration. For example, the attacker checks if:
- "$debug" mode is needed for any diagnostics reasons. ("1" = enabled, "0" = disabled. The log file is placed in /tmp/[scriptname]debug.log)_
- "$ourIP" matches the attacker's IP address. (ifconfig [interface])
- "$baseDir" is a local path for a folder that is accessible to the webserver and is writeable by "nobody" - as Squid is running at this user level and it executes the perl scripts. (Apache default web path is /var/www/. However the attacker creates a subfolder, "tmp/" to use)
- "$baseURL" would be the visible path for "$baseDir". (
- "$convert" , "$convert" and "$jp2a" are the paths to the necessarily programs (whereis [programsname])
Note: The variables depend on each script. The example above was taken from "asciiImages.pl".
After this, the attacker moves on to configure the files and folder permissionsto allow the necessary daemonsto be able to interact correctly. The daemons are then restarted to re-load the configuration files in the new environment. The last stage in preparing the attacker's machine is to manage the ports, as the standard HTTP port for web traffic is on port 80, however Squid is running on 3128 on the attacker's machine (and their web server, which is needed, is also on port 80). The attacker redirects the traffic into the proxy, therefore squid is used. This is achieved with iptables.
Everything is now in place...
... However the attacker wishes to change scripts. So after stopping the attack (and correctly re-posing the ARP tables), the attacker edits Squid's configuration file once more and modifies it to reflect the new script. After restarting the daemon once more, to load the new configuration, the attacker attacks once more with ARP cache poisoning. This process is done, until they have had enough.
... But this isn't enough for the attacker. The attacker decides to install a "Web filter". As the attacker has permission from the target to execute these attacks, the attacker has checked (and double checked) that the target is "of age" and is in an environment where "adult material" is "accepted", they "reserve the logic" of DansGuardian. This means, what was "filtered" is now allowed; therefore what was allowed is now blocked.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
- Credit & thanks to Pete Stevens (http://www.ex-parrot.com/pete/) for inspiration with "Upside-down-ternet".
- Credit & thanks to Charlie Vedaa & an "anonymous speaker" (prank-o-matic.com) as a lot of the scripts originated from them & their presentation at Defcon 17.
- You may have to edit the script, to change the default variables. For example, the default IP for the attackers IP is 192.168.0.33.
- I didn't see a need to keep switching from the attacker/target on every script change, but you can see how it was done via "blurImage.pl".
- Instead of doing a "rehearsal", I went straight in with recording it (to try and save sometime), which resulted in a few things needed "tweaking", hence the jumpiness of the video in places – I did my best to patch it together. This is the reason why a few images were loaded from cache, Internet history/Back-forward arrows were sometimes "wrong".
- I like to keep my videos as short as possible (so they are "straight to the point"). However, this time around, I tried editing them in-time to the music (or at least the (first) song)_.
- The Virtual Machine I used to record the video in wasn't that powerful hence it took "a while to process" on the target side.
- "Convert" which is used to manipulate images in a few scripts has been found to keep running after squid/script has been stopped, as a result using up processing power. If this happens: "killall convert" should kill it.
- Depending on how intently you watched the video, you might have seen a bash script to automate all of this... This will be released at a later date.
- This was my first time releasing something I've coded using perl. I'm sure it could be done "better" – but as the originals were done in PERL – I stuck with it.
- There is an extra command for "iptables" which wasn't included in the video, but it’s used for "blackhole routing" – as it redirects all traffic, even if the target has the DNS entries cached.
Video length: 8:17
Capture length: 44:00