The second experiment 201 721 440 012

Chinese People's Public Security University

Chinese people’ public security university

 

Network Warfare Technology

experimental report

 

The second experiment

Network sniffing and spoofing

 

 

 

student name

Yinxian Pei 

grade

 2017 Ji

District Team

 Network Security four districts

mentor

 Your opinion

 

 

Institute of Technology and Information Network Security

201 9 Nian 11 Yue 11 Ri

 

Master experimental task

2019-2020  school year, Di Yi semester   

First, the purpose of the experiment

1 . Deepen and digest this course lectures, review what they have learned through the Internet search techniques, methods and techniques;

2 . Become familiar with commonly used network sniffer way to master the common packet capture and filtering techniques to use software can analyze network basic behavior of a given data packet; grasp ARP basic principles of deception, based on ARP spoofing DNS attack;

3 . The purpose of the consolidation of curriculum knowledge and practical application.

Second, the experimental requirements

1 . Carefully read the contents of each experiment, we need to capture the title, to be clear screenshots and annotate screenshots and descriptions.

2 . Documentation Requirements clear structure, graphic expression accurate labeling specifications. Reasoning was objective, reasonable and logical.

3 . Software tools can be used office2003 or 2007 , CAIN , Wireshark and so on.

4 . After the experiment, to retain electronic documents.

Third, the experimental procedures

1 . ready

Experimental preparation well in advance, should learn more about the purpose of the experiment, test requirements and test content before the experiment, familiar with the software tools and ready with a good experiment, in accordance with the requirements of experimental content and experimental content ready ahead of time.

2 . lab environment

Describes the hardware and software environment used in the experiment (including a variety of software tools);

Boot and start the software office2003 or 2007 , browser, Wireshark , CAIN .

Tools Download:
CAIN https://pan.baidu.com/s/19qDb7xbj1L_2QnoPm71KzA

Wireshark    link: https://pan.baidu.com/s/1BeXghjVV9Mll_cAmeMCTPg Password: mbpv

Mini FTP https://pan.baidu.com/s/16ms4hXVOmMHhDEe3WraRHQ

NetworkMiner  https://pan.baidu.com/s/14e3VluLPjWFKxqNhdpYO9Q

3 . experiment procedure

1 ) Start the system and start-up tool environment.

2 ) realization of experimental content using software tools.

4 . experimental report

Write lab reports in accordance with the standard requirements of the test report format. The document prepared in accordance with the format template embedded test report document, the document written in accordance with the provisions of the written format, the form must be said that the graphics have a table Illustrated.

The first part of the   ARP spoofing 

2. The front spoofing attacks by Arp-a command to verify successful deception (screenshot attached)

 

 

 

 

 

 

188 and 197 of the target host mac address has become the attacking host 196 of the mac address

5. After the completion of deception, the host C is successfully acquired FTP username and password (screenshot attached)

 

 

 

 

ARP spoofing attack the process show

Query the status of the victim host before being deceived

ARP ago deception 192.168. 31.188 machine normal cache table ( experiment IP possible and this IP is not the same )

 

 

 

ARP欺骗前192.168.31.197机正常缓存表(实验中的IP可能和本IP不一样)

 

 

 

2、在192.168.1.50(实验中的IP可能和这个不一样)号机器上运行cain,选择要嗅探的网卡(单网卡,默认就可以)

 

 

 

3、选中ARP-》点下列表栏空白处,大加号变为可选-》点大加号,在弹出的窗口中选择要嗅探的目标主机(注意这里的选择和单击欺骗嗅探不一样,左面直接点网关,其它机器自动出现在右侧列表中,这时需要按住ctrl键在右侧选择你需要嗅探的主机,如图所示)

 

 

 

oK按钮,回到软件主窗体,如图所示(这是欺骗两台机器)

4、点击工具栏第三个图标(start ARP)就可以ARP欺骗了

下图为欺骗开始后在192.168.31.188机器上用arp –a命令查询本机arp缓存表的情况,会发现缓存表中的网关对应的MAC地址变成了192.168.31.196ARP欺骗的机器)的IP地址

 

 

 

 

下图为欺骗开始后在192.168.1.30机器上用arp –a命令查询本机arp缓存表的情况,会发现缓存表中的网关对应的MAC地址变成了192.168.1.50号机(实施ARP欺骗的机器)的IP地址

 

 

 

抓获188197主机ftp连接的用户名和密码包

 

 

 

 

第二部分 DNS

 

1. 两个同学一组,AB

2.A同学正常访问网站www.ppsuc.edu.cn

3.B同学扮演攻击者,设计攻击方法,使用CAIN,通过DNS欺骗的方式,让A同学访问www.ppsuc.edu.cn网址的时候,访问到另外一台机器上的伪造网站

 

重点步骤

 CAIN中添加DNS欺骗选项

 

 

 

欺骗成功后,在被害机器上查看www.ppsuc.edu.cnIP 查看是否被解析到了,指定的IP地址上。

 

 

 

 第三部分 FTP协议分析

 

1. 两个同学一组,AB

2.A同学架设FTP服务器,并设置用户名和密码,例如gao / gao

3.B同学在机器中安装Wireshark,并将其打开;之后用用户名和密码登陆A同学的FTP服务器,并上传一张图片。

4.B同学停止Wireshark抓包,并和A同学一起分析数据包中的FTP登录过程,还原登录用户名和密码,以及上传文件。

 

欺骗后188登陆ftp

 

 

 

 

188被欺骗前

 

 

 

 

抓包抓到用户名和密码

 

 

 

 

欺骗前并搭建ftp

 

 

 

 

欺骗成功

 

 

 

 

配置

 

 

 

Guess you like

Origin www.cnblogs.com/P201721440012/p/11980173.html