Sniffing with Xerosploit – An Advanced MITM Framework

Xerosploit is an open-source framework that makes it easy to perform man-in-the-middle (MITM) attacks on networks you have access to. The goal of an MITM attack is to get between two parties communicating and intercept or even alter their communications without them realizing it. The key advantage of Xerosploit is it automates many complex MITM attack techniques so even a beginner can sniff lots of sensitive information off a network. However, it is meant only for ethical, authorized testing, as MITM attacks capture private data and can violate wiretapping laws.

What is Xerosploit – An Advanced MITM Framework?

Xerosploit is an open-source tool that allows you to perform man-in-the-middle (MITM) attacks on networks you have access to. An MITM attack works by getting in between two communicating devices without them knowing, intercepting and potentially altering their communications. Xerosploit makes MITM attacks easier by automating techniques like ARP poisoning. Once intercepting traffic, Xerosploit has different modules to analyze or modify before passing it on to the intended recipient. For example, capturing passwords or altering web traffic. While powerful, Xerosploit is meant only for authorized penetration testing. MITM attacks capture private information and can violate wiretapping laws. Use ethically and at your own risk.

What is Sniffing?

Sniffing refers to intercepting and logging traffic flowing through a digital network. It allows capturing and viewing data in transit between devices. On a shared network like WiFi, sniffing tools can monitor communication between other devices. By sniffing plaintext traffic, one can extract passwords, messages, emails, and other sensitive information. Sniffing works by putting the network interface into promiscuous mode. This forces it to intercept all network packets, not just those addressed to the device. These packets can then be assembled and analyzed. Common sniffing tools include Wireshark, tcpdump, and applications like Xerosploit that automate sniffing attacks. However sniffing can violate privacy laws. Ethical authorization and usage are crucial.

How to Install Xerosploit – An Advanced MITM Framework on Linux?

Step 1: Clone the Xerosploit repository from GitHub

Open a web browser and search for “Xerosploit GitHub” to navigate to the official code repository page. Click on the first result to open the Xerosploit GitHub repository and copy the code.

Copy the Repository Link

Step 2: Installing the Xerosploit on the Desktop

Now that we have copied the GitHub repository URL, we can clone Xerosploit onto our desktop for easy access and launch. First, we will change directories to the Desktop folder using the cd command :

cd Desktop

Change the Directory to Desktop

Next, we execute the git clone command along with the copied GitHub repo link:

git clone https://github.com/LionSec/xerosploit.git

Clone the Repository

Step 3: Change Directory to Xerosploit

Now that we have cloned the Xerosploit repository onto our desktop, the final setup step is to go into the newly created Xerosploit directory so we can access the tool’s code and execute the commands properly.

cd xerosploit
ls

Go into the Xerosploit Directory

Step 4: Allowing the Executable Permissions

Now that Xerosploit is cloned locally, we need to set the execute permission on the install script to allow formally installing dependencies and finalizing our Installation.

chmod +x install.py

Give the Executable Permission to ” install.py ” file

Step 5: Run the ” install.py ” File

Now we have set the execute permissions on the install.py script, we can trigger it to finalize the installation of Xerosploit:

sudo ./install.py

Installing the “install.py” file

Choose the Operating System you are using and want to install the Tool. As we are using Kali Linux, so we will select Option 1.

Select your Operating System

When the Installation is completed, you will see the Prompt like the Below Image Indicating that the Installation is Completed.

Tool Installed Successfully

How to Perform Sniffing Attack with Xerosploit Framework?

Step 1: Launch the Xerosploit Framework

Now that Xerosploit is fully installed, we can launch the core framework to access its web penetration testing capabilities. To do this by running the main execution script xerosploit.py from within our cloned repository directory :

xerosploit

Launching Xerosploit Framework

Step 2: List of the Modules

The Xerosploit console now running, our next step should be to see the available modules and commands before proceeding with scanning or exploitation. The help command will output a listing of all built-in Xerosploit modules we can use.

help

List of the Available Modules

Step 3: Scanning the Network

Now that we have an overview of Xerosploit’s capabilities, we can begin reconnaissance and information gathering on our web application target. The scan module provides automated crawling, mapping, and auditing of the target site to detect surface vulnerabilities. We can run a scan using:

scan

Scanning the Available Networks

Step 4: Select the Target

We simply copy our intended IP Address target into the input, paste it at the prompt, and hit enter to confirm the selection.

Select the Target IP address & Paste it

After Pasting the IP address you can see the Prompt of that your Target is Set.

Target is Set

Step 5: Setting up the Sniffing Module

After Setting up the Target we need to set the Module that we want to use. Use the following Command to list the Modules.

help

This is the List of our Modules Below :

List of the Modules using the “help” Command

Step 6: Using the Sniff Module

Xerosploit has a useful sniff module that lets us intercept and analyze web traffic to and from the target during assessments. We can enable network sniffing in Xerosploit using a three-step process:

1. First, we load the sniffer module:

sniff

2. Next, we activate continuous sniffing by running:

run

3. Finally, we permit the inclusion of Loading the SSLstrip data with:

y

Using the Sniff Module

Step 7: Captured & Intercepted Data from the IP Address

After Running all the above commands you can see Some windows popping up, which captures the data. When the Victim opens the Browser and Surf the websites, then all the surf data will be sniffed and shown in the opened windows.

Intercepting the Victim’s IP Address.

In the below screenshot, you can see the Captured Data and the Visited Sites from the victim’s Computer and Overall Data Packets.

Visited Websites and Overall Data

Conclusion

In conclusion, Xerosploit makes MITM attacks easier to conduct by using techniques like ARP poisoning to intercept traffic on a network you have access to. It then provides modules to analyze or even modify this intercepted traffic before passing it on. This allows capturing sensitive information like passwords, messages, etc. flowing through the network. Essentially Xerosploit allows “sniffing” or spying on network communications. However, MITM attacks and sniffing can violate privacy laws. Xerosploit should only be used for authorized testing purposes and by those who understand these attacks are unethical without consent. There are better ways to learn about network security.