Get Usernames and Passwords with Ettercap, ARP Poisoning (Cybersecurity)

[@josephjefferson2617]

Thank you, Brother Yang. Your presentation is short, sweet, confident, and possibly the best I've seen on ARP Poisoning so far. Thanks again, Joe Jefferson - Grad Student, Fort Hays State University.

[@fmgamingnocap]

When you try to hack the NSA but he still say "For educational purposes." Hi to my NSA agent.

[@LoiLiangYang]

Subscribe to the channel now to learn all about cyber-security.

[@frostkiller]

Welcome to another episode of " where did quarantine took me today?

[@thatfewanimation6971]

*take

[@frostkiller]

@@thatfewanimation6971 merci!

[@MayFlyIDK]

Exactly, that’s how I started programming and hacking, because of the Quarantine.

[@roarguner4007]

Welcome to another episode" of who needs Grammerly

[@frostkiller]

@@roarguner4007 so funny I forgot to laugh

[@adamfadilah7407]

🎯 Key Takeaways for quick navigation: 00:00 🚀 Introduction to ARP Poisoning with Ettercap 03:11 🔍 Scanning and Targeting Hosts with Ettercap 04:48 📡 Configuring Wireshark and Launching ARP Poisoning 05:32 🪙 Intercepting Credentials in a Man-in-the-Middle Attack 06:25 👍 Conclusion and Call to Action Made with HARPA AI

[@saleh.alqahtani]

Your videos are helpful but please always point out by mouse to see which ip and which things you are talking about so it will be easier for us to implement 👍🏼

[@nelsonortiz9699]

very well explained thanks! I would add more detail, i.e., show the IP and MAC of Kali, the Win10, and the Metasploitable before and after ARP cache poisoning.

[@josephjefferson2617]

Hey Nelson, help us out. Continue what you think Brother Yang left out. joe.

[@bullymaguire9849]

Seems like there’s a ‘smile’ button hidden somewhere & someone is randomly pressing it while you’re talking that causes you to smile 😂 😂

[@yasyasmarangoz3577]

lol

[@raymondsabee]

Dub dub dub

[@freewillie2837]

Hahahaha he also blinked 24 times during the video

[@yasyasmarangoz3577]

@@freewillie2837 That's not uncommon

[@cedrichartz6426]

Yeah i found it Creepy

[@Kwame_Kwao]

You are a genius,thousands likes for you!!👍

[@JanRautiainen]

I will need to check more into ettercap, thanks for sharing this bit of information

[@Spelborea]

Cain & Abel was the best tool. I miss it so much!!!!

[@chindilindi888]

the target browser is slow if you are using a different target machine within your network. It only works if the VM and the target machine is the same machine

[@cn4462]

Thank you Loi, We are so grateful to you for sharing this knowledge..

[@exeplays7212]

You know its working, when your mobile gives you an alert, that the wifi is not safe

[@industrious3203]

Brother Yang you're the man, and thank you for this.

[@MeThOs28]

Why you have so less views ... Man you blow my mind with these tips and tricks.... I am becoming legendary hacker in my neighborhood becuz of you ... Love you man for all this..... Edit : m not legendary hacker but I just follow your steps... Thanks again...

[@hahaha3541]

🐸🐸

[@techzone9026]

Excellent work brother👌..

[@bulmavegeta23]

Este video tuto no lo realizaste con una pagina real, el texto que vieja esta en http lo cual indica que no cuenta con el cifrado de extremo a extremo y tampoco tiene el protocolo Seguro HSTS. A donde quiero llegar es que ettercap fue bueno en su momento con backtrack pero ahora con todos los cambios no funciona. Si alguien puede traducir este texto para que lo pueda leer, se lo agradezco.

[@lineasdecodigo]

@Zero_ El https, lo implementas directamente desde tu proveedor en el que tienes alojado tu dominio, en algunos el costo es adicional, es el cifrado SSL para poder tener el https en tu página.

[@charichari8118]

No me dejan copia para traducir gracias for la info

[@Pedrods24]

Amazing video. You make my interest in those topics go even higher. Did it using a Raspberry Pi and worked like a charm. However i did not understand why do we need to set ip_forward to 1. What would happen if we let it at 0?

[@rationalism_communism]

because we can capture traffic

[@robi4783]

That makes to transmit the data between router and victim through us. In other words, the victim are not sending data to router, he sent to us (we collect all data from the victim) and we send to the router.

[@samyehya]

@@robi4783 but what how does switching it to 1 change that

[@samyehya]

@@rationalism_communism I get that, but how does it make a difference?

[@rationalism_communism]

@@samyehya when it is set to 0 meaning your not capturing traffic when to 1 your telling your system to be capturing trafffic.

[@certain6441]

Amazing really amazing...

[@bravo-6900]

I admire you Sensei.

[@achajackson5898]

If the website was secure and traffic encrypted. Would you still see the credentials? Also, would you atleast see the app or website the target is visiting? Also, I didn’t really see the wireshark in use. Wireshark just scanned and was showing that ARP parakets are being exchanged. Anyways thanks!

[@Browsqq]

so if the website traffic is encrypted this attack becomes unuseful@user-ll8rj6xl3i

[@insaansha3897]

Wonderful and extraordinary sir

[@NoConstra1nt]

Good work Mr Yang

[@jimikalby3109]

Thanks for your good videos

[@ITHunt-]

Very useful I like this channel

[@saiakhileshm2127]

this attack can be directly done without using wire shock as I don't want to look at the traffic of the target machines?

[@sawansharma3491]

What network types you are using for all vm to communicate with each other is it NAT or Internal Network in network setting .

[@imad-eddinenaciri6238]

For a practical using you should use The 'Bridge' network type because the VMs take a IP adress from the range of your Wifi or Network

[@NoongarCulture]

Love your work!!

[@philipgeneta7046]

is this still usable today?

[@kishoreraja6385]

ya you use your local server in win machine but what if the user visits a webpage with https ? what to do with those encrypted data?

[@soutasiantraveller6493]

nothing much

[@Superputiano]

If i want to study cibersecurity but i'm bad in math, ¿should i do a FP in spain about "ASIR" with courses and certificates or the university with a master?

[@carlosdevil666]

Very helpfull Loi. You got yourself another subscriber and I'm gonna tell other people about your channel.

[@nikhilchandnani8655]

Does this only work for http? Or it also works for https? Because almost every site now runs on https

[@killmill3420]

thank you for the video. What I dont get yet is why you need the metasploitable machine for? I mean the cliunt is not asking anything from that server right? I did the same hack, but I usde an other linux machine and my router, because to me it makes sense that every trafiic will ppass through the router. But I really dont see how the metasploitable fits in this picture. Please explain to me sir..

[@francescooliva5951]

please can u say me if network configuration is only host network?? our prof says us that it is good to prevent possible damages. but if i want to go on internet how i must do? only host network dont permit me to go on internet. please help me.. i dont want to make mistakes

[@icapsicaps3817]

The victims machines/ip that you got are the ones in the same network with you? How can I do it outside my own network

[@shellbr3ak443]

the target IP and the internet ;)

[@kishansudani5946]

You have to access WAN for to do that you need port forwarding

[@kishansudani5946]

Or you have to use ngrok or servo

[@freewillie2837]

@@kishansudani5946 or whonix, to don't worry about config

[@swagmuffin9000]

do i need to do anything to hide myself like changing my mac address or something else?

[@MOHANRAJ-ki5ff]

Sir iam watch lot of vedio for haking.. Thank you sir.. On my question is iam a beginner what are the basic needs for haking..

[@VirendraSingh-vj2pz]

Better learn English before "haking" coz u know a lot of scripts & program run on english lang. and it would be more useful in long run compare to your "haking"!!

[@CarryTheThree]

Focus on Dorking/ or Data Mining first, get some Good techniques,..Save every technique,. create Phishing Programs,..for starters,..you can Often gain a lot from Data Mining.. idk what your actual goal is..i like getting people to give me.. stuff..That's what i did when i was Young..Target specific apps and Users who are Greedy..don't go after people maliciously, or go after Tryhards,let them feel that they have won,.. win in your own way.

[@vigh8313]

Get the basics , Hit the hard way First find a base, it can be a video , document even a youtube comment (how i started) You can use anything that gives information you need in the form you can understand There are going to be errors lots of them, try harder (Try wifi hacking) IOT will show you phase2

[@GeekTechTutorial]

bettercap ssl capture tutorial video make plz

[@mrsimo7144]

Brilliant. Thanks

[@phillydee3592]

Damn,didn't know it was that easy!!!Scary!!!

[@sunnygrewal9591]

Dear sir, please make a video on WiFi password hacking, that would be really helpful, thank in advance 🥰🥰

[@emmanueldamilare211]

😂😂😂👏🏾

[@ankitprakash895]

Slow clap

[@darshilmehta9905]

hey does it work for any login page or specific only ? Because i tried login into my router console but i could never sniff the password in ettercap .

[@AlhassD]

not working for crypted connection with ssl like https protocole

[@rockymokesh2.065]

thank you

[@mridulmitra2512]

Do we need both the targets and the attack machine in the same network?

[@Lost4ever-y1q]

Yes

[@blakebotha9697]

Yes do you

[@exCalibur001]

Will this work on HTTPS enabled websites since it encrypts the form data before sending it to sever ?

[@ahmedmani1051]

It wont

[@wazibabor3854]

want to learn about penetration testing full course .how can you help me?

[@deathzone9620]

best explained

[@gautampramod1734]

SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. maybe because of this error the credentials does not show in ettercap.. please help..

[@spitmuk]

Dunno if you ever fixed this but you need to remove the # from the conf file

[@whoami-tpx]

can you make a tutorial on how to make undetectable backdoors for "educational purposes"

[@monsterx1563]

Make your own from 0 use 0day's exploits

[@2ubZ3r0]

Nice work sir

[@lesterdilworth1174]

if you see zsh permission denied, just do echo 1 | sudo tee and the /proc/...command

[@oxy_786]

use sudo

[@abdulhamidsulton]

thank you so much

[@NeeoDroid]

Life saver thanks man

[@mehd-q1w]

the multilliade page from where came up ???

[@muhammadshiekh1920]

It's method it's just for wifi ip address. Or for any website.

[@oxy_786]

wdym?, if you are connected to same wifi network then you can gain access

[@saleh.alqahtani]

So can i still do this attack while we are both on secure network and connected to it ?

[@BossNature]

what about https I mean wireshark it also show the plain text but not the https (encrypted) text or packets. how can i see or decrypt that?

[@trippyfierce9759]

Tried it on my own computers, didn’t seem to work as far as finding log in info

[@vinodleo13]

thank you very much

[@MissBarq]

I couldn’t get the login information, is it because of the website that I was trying to login at or is there any other reason? Also what is the website that you logged in in¿

[@jkw_915]

so what does target one and target two have that is different from eachother and which one do i add the other device into? can someone please help?

[@oxy_786]

they re both different targets, you could use only one

[@YashOswalYO]

why did you do ip_forward to 1?

[@keegan7736]

Remember to press sneef guys. No but good video for newbies uploader

[@hiteshgorantla1566]

ettercap 0.8.ed the menu option are visible. Can you share the latest video on this? It will be helpful.

[@weird9890]

Does this work for any website that the person logs into?

[@abramduque722]

Now i know thanks...

[@WoLFyy2009]

u can use one target why 2?

[@AlhassD]

the first one is the gateway it can be your router and the second is the target machine

[@SharlRajan]

its only for HTTP not for HTTPS.. in fact via wireshark.. it will never happen

[@maltesetoy3653]

You can see the information just from the reason that you entered to not encrypted site..it is not working in encrypted sites

[@edmonddantes218]

hey, can som1 help me please. why do i only see 1 host (my linux device) as host... isnt supposed to scan all the devices on my network ?

[@abdulrahmanhs8162]

Maybe you have set up your machine to be isolated from the outer network environment

[@phantom3474]

it's good but i don't think it's gonna work on chrome or firefox or any https website ... it's oky if you say that in your video just for demonstration

[@TheRam359]

sir, why my target get internet lost?

[@marioneves177]

Is the built in Wifi card of an raspberry pi enough to perform man in the middle attack?

[@Kuwabarashibuya]

Yes

[@oxy_786]

ethernet or wireless works too

[@antoniocarmellino1850]

Thanks

[@rizqisyaifulrijal8349]

Only works on http not https?

[@citizenoftheworld4938]

Can you use it to get someone's Facebook or Instagram username and passwords

[@MuthuKumar-pg6ir]

how to do with ettercap-0.8.3(EB) ? pls help

[@tzcommunity8799]

Is it required to be on the same Network ?

[@reda4632]

yep

[@GG-tk3rz]

Does this work with HTTPS websites?

[@MrLeftRight]

sir i need some help. how we get victim ip adress , for example using some link or etc

[@LoiLiangYang]

that will be via browser exploitation framework: kzbin.info/www/bejne/rZ-4q2WjjteSpLc

[@MrLeftRight]

Sir. 😘 you are genius. 👏

[@withrejkapermana6087]

5:30, it is using ssl?

[@jaysuryasah8780]

Nice video, can you tell me what are the requirements to hack username and password of any website...

[@Impuritex]

Jeez your eyebrows

[@ahmedmani1051]

A lg fridge

[@akefmasood1942]

Do u have to b on the same network as the target

[@user-ud4dc1ds2l]

I think so

[@daffodilenriquez-gt6li]

i tried it but when i start sniffing it says not permitted

[@chandrasekharan5939]

Hey loi when I do arp poisoning it shows me the error "send L3 error 69 byte packet destined was not forwarded"

[@antoniodev5167]

where did you learn ettercap please? Can someone tell me ?

[@oxy_786]

apt install ettercap-graphical

[@oxy_786]

make sure you are root

[@aymanbabiker7030]

You are a genius, if you get my point...can i capture different IP in wan networks.

[@iamb9]

Nope. Also you can not hack https. It's only works for http.🤪

[@snapshortproduction]

Ist important the device should be connected on that time.

[@nishantdalvi9470]

Why was IP forwarding enabled here ?

[@Crisplz16]

ettercap not snifing in my laptop :(

[@Khurram_CA]

I'm unable to open this site which you were using in Windows for login... Anyone can help? Or suggest me any other website which I can use to login and then see those credentials in ettercap..

[@ZiangSecurity]

You will arrive on the same objective even if you will not run wireshark

[@Zer0madeItHappen]

How do I identify the login request for every site

[@poncecaribe6227]

What are the chances for home users to be victim of this attack?

[@rohitkumaryadavyadav2660]

Thats grateful

[@rjclado4754]

you can use it to someones phone victim? and you chose eth0 because you are using virtual windows os? am i right?

[@mortazahassan456]

Loved it

[@85gr]

How to stop this but i click a stop mitm attack and this is not stopped

[@85gr]

please help me but this is my router

[@kingsrilankan7163]

Hi sir. how to Join your channel. Some vedios can’t open without joining your channel

[@Nickie11547]

Sir, Can you give us a tutorial of using this software and receiving passwords from a remote pc

[@areeb.chaudhary]

How remote is it? Is it across the subnet for instance your subnet is 192.168.1.X and the pc's subnet is 192.168.2.X . Or on a completely different network say on 10.0.0.X behind a NAT. In either case as the name indicates MITM requires a man in the middle. So it will be impossible for a novice. But you can use RATS and WORMS by using some DDNS if you have dynamic public ip which most likely is and port forwarding on your end (PF is necessary if you are using a random TCP_Port like 4444 used by metasploit's payload on default, but if you use say https to establish the connection, it won''t be necessary as 443 is already opened in consumer grade NAT's). BTW what type of traffic (assuming it is in person's knowledge of whom you're trying to get) are you interested in??

[@Nickie11547]

@@areeb.chaudhary the remote pc is 20 km away from mine.

[@kxno8302]

@@Nickie11547 no its impossible... only if he is on your network

[@kxno8302]

@@Nickie11547 but you can install a rat to gather pass,... with a keylogger

[@Nickie11547]

@@kxno8302 can you suggest me any tutorial please