Exploring binary injection with BetterCAP
In Chapter 3, Sniffing and Spoofing, we explored custom filters with Ettercap to manipulate traffic on the fly. When we can serve as the go-between, the possibilities are exciting: we can manipulate messages between the server and user, even to the extent of delivering an executable masquerading as their requested file. BetterCAP continues to make things better (and easier) by allowing for slick automation of this process. In this exercise, we’re going to prepare a malicious executable for a Windows target and call it setup.exe. Then, we’ll set up a man-in-the-middle proxy attack that will intercept an HTTP request for an installer and invisibly replace the downloaded binary with ours. We’ll be covering these concepts and tools in more detail later in this book, so consider this an introduction to the power of custom modules in advanced man-in-the-middle attacks.
The magic of download hijacking
Now, curl up with...
