 |
| MITM Attack |
MITM Attack.
A man-in-the-middle attack is a type of cyberattack where a malicious actor inserts him/herself into a conversation between two parties, impersonates both parties and gains access to information that the two parties were trying to send to each other. A man-in-the-middle attack allows a malicious actor to intercept, send and receive data meant for someone else, or not meant to be sent at all, without either outside party knowing until it is too late. Man-in-the-middle attacks can be abbreviated in many ways, including MITM, MitM, MiM or MIM.
Tools for MITM Attack.
There are many tools that are used in MITM Attack. Hackers can use these tools to hack your system, steal your data and important information and for many other operations.
All these tools are as follows.
MetaSploit Framework.
Metasploit Framework - an open source tool for exploit development and penetration testing. Metasploit is well known in the security community. Metasploit has exploits for both server and client based attacks; with feature packed communication modules (meterpreter) that make pwning systems fun! The framework now includes Armitage for point and click network exploitation. This is the go to tool if you want to break into a network or computer system.
Defending against Metasploit:
Keep all software updated with the latest security patches.
Use strong passwords on all systems.
Deploy network services with secure configurations.
Ettercap.
It is a suite of tools for man in the middle attacks (MITM). Once you have initiated a man in the middle attack with Ettercap use the modules and scripting capabilities to manipulate or inject traffic on the fly. Sniffing data and passwords are just the beginning; inject to exploit FTW!
Defending against Ettercap:
Understand that ARP poisoning is not difficult in a typical switched network.
Lock down network ports.
Use secure switch configurations and NAC if risk is sufficient.
SSLStrip.
It is using HTTPS makes people feel warm, fuzzy and secure. Using sslstrip this security can be attacked, reducing the connection to an unencrypted HTTP session, whereby all the traffic is readable. Banking details, passwords and emails from your boss all in the clear. Even includes a nifty feature where the favicon on the unencrypted connection is replaced with a padlock just to make the user keep that warm and fuzzy feeling.
Defending against sslstrip:
Be aware of the possibility of MITM attacks (arp, proxies / gateway, wireless).
Look for sudden protocol changes in browser bar. Not really a technical mitigation!
Social Engineer Toolkit.
Social Engineer Toolkit - makes creating a social engineered client side attack way too easy. Creates the spear phish, sends the email and serves the malicious exploit. SET is the open source client side attack weapon of choice.
Defending against SET:
User awareness training around spear phishing attacks.
Strong Email and Web filtering controls.
SQLmap.
SQL Injection is an attack vector that has been around for over 10 years. Yet it is still the easiest way to get dumps of entire databases of information. Sqlmap is not only a highly accurate tool for detecting sql injection; but also has the capability to dump information from the database and to even launch attacks that can result in operating system shell access on the vulnerable system.
Defending against sqlmap:
Filter all input on dynamic websites (secure the web applications).
Use mod_proxy or other web based filtering controls to help block malicious injection attacks (not ideal as often able to bypass these web application firewalls (WAF).
Aircrack-NG.
It is used breaking holes in wireless networks for fun and profit. A suite of tools that enables all manner of wireless network attacks.
Defending against aircrack-ng:
Never use WEP
When using WPA2 with pre-shared keys, ensure passwords are strong (10+ characters non-dictionary based passwords).
Cain and Abel.
It is used for cracking passwords, sniffing VOIP and Man in the Middle (MITM) attacks against RDP are just a few examples of the many features of this Windows only tool.
Defending against Cain and Abel:
Be aware of the possibility of MITM attacks (arp attacks, untrusted proxy / gateway, wireless).
Use strong passwords everywhere.
Zmap & Masscan.
Zmap & masscan - When it comes to Port Scanners, the one at the top is no doubt Nmap. It is a utility that everyone should have available. When it comes to large scale scanning Zmap and masscan are two newer tools that are crazy fast. Scanning the whole IPv4 internet fast.
Defending against Zmap & Masscan:
Know Your Attack Surface and ensure your firewall is well configured.
These are all tools that are in MITM Attack. There are many other tools available for this MITM Attack.
0 Comments:
Thanks for your comment.