MITM - WIFI HONEPOT - Part 2

In this post we will see what are the thing we can do with the clients who have connected to us via the Fake Ap ..

Note if you haven't read and followed what we did in our previous post I recommend you check that first .

MITM Wifi Honeypot - part 1

 Ok.. so we have created the Fake AP , our client is connected to us and we have supplied them with our dhcp pool of address .. With this all done lets begin the FUN part..

What we will be doing ?

We will be doing dns spoofing that is we will forward all our client's request to our own computer so that we can monitor the request and even modify them if we want to and get all those details like the sites visited , sites user name and password ..and even modify those request and response .. sounds lot of fun lets get going ..

DNS spoofing 

to do dns spoofing type

dnsspoof -i at0

what we are doing is that we are forwarding all the dns request of our client to our own ip address ..  we should be able to see something like this

now thats done we have dns spoofing running and every client request is being forwarded to our own ip address now we will bind a proxy to our ip address so that we can intercept and create a transparent proxy so that the client may be able to connect to the Internet.

Note : we must be connected to the Internet for the client to be able to connect to the Internet .

ok lets start burpsuite

Now go to the Proxy Tab and to the Options tab of it click on Add

Type In 80 In the bind to port box
and select your router address or your at0 address in our case it is 192.168.0.1
And click on request handling tab and check the tick box for support Invisible proxying
click on ok and we are done ..

Repeat the same with port no 443 to handle HTTPS requests :P


Now you can see any request the client makes in the intercept tab and you can tamper with it monitor it forward it or even drop it .. You are the BOSS now :D .. you can even get login id and passwords of different site the client uses .. but while using https site the client will get a warning ..which most of the time they ignore :D

If you have any queries feel free to ask ..



Happy Hacking .. Stay SAFE