DAY - 5 | PYTHON FOR ETHICAL HACKING - BUILD YOUR OWN CYBERSECURITY TOOLKIT - 5 DAYS FREE LIVE

Introduction and Session Overview

Opening Remarks

• The speaker greets the audience, asking if there are any doubts from previous sessions.

• Participants introduce themselves, sharing light-hearted comments about personal updates like haircuts.

• The speaker acknowledges participants from various countries, including India and South Africa.

Session Focus

• The session begins with a shift in focus from intercepting packets to modifying them.

• Previous tools used for packet creation and analysis (like Scapy) cannot modify packets directly.

Packet Modification Techniques

Introduction to New Tools

• Two new programs are introduced: Network Jammer (NetCut) and DNS Scooper.

• Explanation of how these tools can manipulate data flow between a victim's PC and the router.

Understanding Packet Flow

• Original requests sent by the victim will still reach the router unless modified before transmission.

• Emphasis on timing; original packets may arrive at the router before modified ones due to processing delays.

Constructing a Solution

Queue Mechanism

• A queue is proposed as a solution to trap incoming packets for modification before they reach their destination.

• Each packet is captured in this queue, allowing selective modification of specific packets.

Implementation Strategy

• Python will be used to create this queue using IP tables and NFQ commands in Kali Linux.

Handling Responses

Modifying Responses

• Discussion on capturing not just requests but also responses for potential modifications during MITM attacks.

Practical Demonstration of Code

Code Overview

• Transition into practical coding examples demonstrating how to implement network jamming techniques using Python libraries like NetFilterQueue.

Creating Queues with IP Tables

Command Execution

• Instructions provided on creating queues using specific IP table commands in Kali Linux for both input and output chains.

Testing Network Jamming

Initial Setup

• Speaker prepares to demonstrate network jamming by running code that should disrupt internet connectivity through packet dropping.

Troubleshooting Code Issues

Debugging Process

• Encountered issues with code execution; troubleshooting steps discussed while attempting to ensure proper functionality of network jamming scripts.

Introduction to DNS Spoofing

Concept Explanation

• Brief overview of DNS functioning; explanation of how domain names translate into IP addresses through DNS queries.

• Importance highlighted regarding potential vulnerabilities when an attacker interceptively modifies these queries.

Capturing DNS Packets

Packet Analysis

• Description of how DNS servers respond with IP addresses upon receiving queries, emphasizing the need for capturing these interactions during attacks.

Modifying DNS Records

Attack Simulation

• Detailed explanation on how attackers can spoof responses by altering fields within captured DNS records, redirecting victims unknowingly towards malicious sites.

Understanding DNS Spoofing and Packet Modification

Overview of DNS Response Record Manipulation

• The speaker discusses accessing a DNS response record using the scpns RR, setting the RR name to the Q name, and modifying the R data to a spoofed IP address.

• An explanation is provided on changing the answer count in the answer field to one, emphasizing its importance for capturing a DNS RR packet.

• The necessity of deleting four specific fields in the answer field is highlighted, as it affects checksum recalculation when modifying packets.

Technical Details of Packet Modification

• The speaker explains that both IP and UDP fields have checksums that need recalculating after packet modification to avoid detection.

• Setting the payload for the modified packet is discussed, indicating readiness to test if the code functions correctly.

Running and Testing DNS Spoofing Script

• The speaker mentions recreating IP table rules due to inconsistent behavior observed with Linux systems while preparing to run a DNS spoofing script.

• A ping command is executed to determine the actual IP address of a target before running the script, establishing a baseline for comparison.

Observations Post-Script Execution

• After executing the script, there’s an observation that shows how DNS spoofing alters expected results; comparing pre-and post-execution IP addresses reveals successful manipulation.

• The modified response includes an injected malicious IP address instead of legitimate ones, demonstrating effective spoofing techniques.

Homework Assignment and Conclusion

• As part of homework, participants are tasked with integrating all scripts into one Python project capable of performing various network tasks including scanning and spoofing.

• The session concludes with encouragement for participants to ask questions about networking basics related to their tasks.