Introduction

MITM 101Easy Traffic Manipulation Techniques Using

Scapy

Introduction

Bob Simpson@bobby_simpson

Bob Simpson has fun researching security…

and is CIO for Finley & Cook, PLLC, and inventor of GhostSentry, a technology that uses MITM techniques for good purposes.

What is MITM?

MITM (aka MiTM, MitM, etc.)

• NOT just sniffing

• Involves getting in the middle of a two-way conversation

• Often explained as Alice talking to Bob, with Mallory in the middle convincing Alice that she’s Bob, and Bob that she’s Alice.

Picture from https://en.wikipedia.org/wiki/Man-in-the-middle_attack

What is MITM?

Let’s do it!

[ DEMO ]

Picture from https://en.wikipedia.org/wiki/Man-in-the-middle_attack

What do we get?

• What do we get?• Reconnaissance (fingerprinting)• NTLM capture, relay, escalation, redirection• SSL bypass• Steal and/or break credentials• Or, simple redirection ( … and the resulting

software download, browser exploit, etc)

What do we get?

• What do we get?• Pwnage!!!

How is it done?

Google it:• Tools:

• Ettercap, Cain and Abel, Arpspoofing, mitmf, websploit, Burp suite, SSL Strip, middler, Fiddler2, Subterfuge, DSniff, wsniff, and commercial stuff (Hack5’s new LanTurtle)

• Methods:

• ICMP redirect, STP Mangling, Route mangling, imposter domains and URLs

• Attacking local systems

• ARP, DNS, STP, hardware

• Attacking remote systems

• DNS, route mangling, proxy and tunneling

How is it done?

Why easy is good:

From the DEF CON

ROOTZ Asylum

area:

Let’s do it!

Our Setup:• Tools:

• Scapy (packet manipulation for Python)

• NFQUEUE (bindings for netfilter queue)

• Method:

• Bridging

Basic Method

• Preparation:• Ubuntu 14.04 (or your own flavor)• Apt-get install bridge-utils, scapy, python-

nfqueue• Execution:• Follow the three steps:

1. Create a Bridge2. Redirect Packets to Scapy3. Mangle to your hearts content

Basic Method

Let’s do it!

[ DEMO ]

Summary

• Preparation• Ubuntu 14.04 (or your own flavor)• Apt-get install bridge-utils, scapy, python-

nfqueue• Execution• Follow the three steps:

1. Create a Bridge2. Redirect Packets to Scapy3. Mangle to your hearts content

Summary

Google Scapy and NFQUEUE for great tutorials

Q&A

What would you like to know?

The End

Bob Simpson@bobby_simpson