All language subtitles for 12. Enabling SSLHTTPS On Webserver

OK so now we know how to generate an SSL certificate and this lecture I'm going to show you how to enable

SSL on apache so that we can support Hastey CPS.

And then we'd be able to use that on our captive portal so that it won't show a warning when people

go to Haiti s ts Web sites to do that.

I'm just going to clear this first and to do that.

All we have to do is just to 8 to 10 Moeed and after that type the mode that you want to enable and

in our case we want to enable SSL.

Now for me it's telling me that it's already enabled.

For you it's just going to enable it.

Now that's perfect.

Next we need to configure Apache to use the certificate and the key that we just created.

So again we have to open the configuration file for Apache that we used before.

So we're going to use Lifford to do that and the file is stored in it we see Apache 2 sites enabled

000 Canth.

So it's the same file that we opened before and in here if you notice you can see that we have a virtual

host for port 80.

And this is the part that's usually used for TTP for normal web pages.

Now if we want to use Hastey CPS I'm just going to navigate all the way down and just create a new virtual

host.

So I'm just going to paste that I've actually copied the one on top and we're going to set the port

here to 4:43 which is the port that's usually used by SSL.

And we'll also have to close the virtual host

and here we're going to say SSL engine

on to enable that we're going to set the location for this certificate so we're going to do SSL certificate

file and set the full path to the location where we have the certificate stored.

And that is in route downloads fake AP and it's called sarod do it.

PM Now you want to said the same so I'm just going to copy this for the key.

So we're going to do SSL certificate key and this time instead of PM It was called Sarot dot key.

Now this is actually supposed to be called key file.

So we created a new virtual host.

We set it to use port 443 because that's the port used for SSL.

We set SSL engine to byone we set the SSL certificate filed to the file that we created in the previous

step and we said the SSL certificate key file to the key that we created in the previous step.

Now we're good.

I'm going to save and quit.

And finally I'm just going to modify the ports file for Apache.

So again I'm going to do Leath pod and that file is stored in it you see Apache to portes

and make sure that I'm listening on port 443 That's the port that we just enabled so you can see that

I'm already listening for port 80.

And I want to listen for port 443.

I'm going to quit this research my apache.

Now this failed so I think I said one of the files.

I said the wrong path to it.

So let me just have another look.

So this should be my cert file.

Let me just see if it actually exists.

I'm just going to do ls and put the file name

and I misspelled something.

Oh it's yet it's certain that P E and not pen.

So that should be there.

Now just let's let's just make sure it's there.

Yep and we'll make sure that I spell this correctly as well.

I always make this OK now that's that's all there.

So I'm just going to save quit and restart apache again.

Now it's asking me for the password that we use we knew when we generated the certificate.

I'm going to enter it now.

Apache is working.

Now let's come back here.

Let's first test it with the normal TTP and make sure that we didn't break anything.

And as you can see now that's working.

So let's go back put t TTP s and see if the web page is going to work.

Now perfect as you can see the web page is working.

Now you can see that it's saying your connection is not secure but that's not because TTP is not working.

That's because we self-signed certificate.

And we just generated it locally on our computer.

But if you remember at the start of the video when I tried to go to the Haitian version literally nothing

happened.

I couldn't even access the web page.

But now the web page is working.

It's just a must that this certificate is not trusted.

Let's go to the target Windows machine connect to my network and try to go to Facebook or any of those

s.c.s Web sites and see what this is going to look like for the client because it's actually going to

look much better than this.

So I'm here at the windows machine.

I'm going to go on my networks and as usual connect to royal Wi-Fi version to and as you can see automatically

I get the log in and I see the bar and we see how to achieve this before so that's not what we're really

interested in.

What we want to see is we want to go to Facebook and see what happens.

Now as you can see this looks amazing.

You can see that.

Just tell us log into network.

It's not showing any errors.

It's not saying that secure connection couldn't be established.

It's basically saying this Web site uses Haik as TS and therefore you just can't browse it please.

Lagann if we click on the logon we go to the log in page where we can log in.

So now anywhere we go.

So let's go to a normal web site like dot com you'll see that we get the normal logon page if we go

to websites that use haziest ts like for example G-mail.

It will just tell us please log in.

We can see the bar in here we can see everything is getting redirected.

The log in page is being displayed automatically for us.

So we've made a really really good fake network that behaves really well it actually acts exactly like

a captive portal.

Not only that but the way the log in screen gets displayed automatically is very convincing.

And I think it'll fool a lot of people even if they have a WPA password and we'll see that later on

in the course.

Now the next lecture I'm going to show you how we're going to be able to capture the passwords.

And third when people log into this web page.