Summary

In this chapter, we took our network attack knowledge to the next level by manipulating binary download streams to inject our own malicious executable. To accomplish this, we introduced Metasploit's ability to generate executable payloads and listen for the connection back from the target. We explored two mechanisms for injecting executables into traffic: BetterCAP proxying with a Ruby module, and ISR Evilgrade to spoof updates for applications; both methods employed ARP and DNS poisoning to redirect traffic. We explored SSL strip attacks and stepped through a practical HSTS bypass technique. Finally, we introduced IPv6 concepts for the security tester, including practical enumeration and recon methods, local segment man-in-the-middle attacks, and relaying from IPv4 tools to IPv6 hosts.