Original subtitles

1 1

So far, we saw a number of things 2

2

that we can do once we become the man in the middle. 3

3

So we saw how we can see anything a target computer 4

4

does on the network. 5

5

So we're able to see the websites, the usernames, 6

6

the passwords, the images, 7

7

anything they load on their browser. 8

8

We also saw that since we're the man in the middle, 9

9

we're able to redirect them to other websites. 10

10

So whenever they request a domain, 11

11

we can redirect them to somewhere else 12

12

by doing a DNS spoofing attack. 13

13

Another really cool thing that we can do 14

14

is modify the HTML, modify the pages 15

15

as they load on the target browser. 16

16

Obviously, this is all possible 17

17

because we are the man in the middle, 18

18

because we're able to intercept all this data. 19

19

So we can wait for the HTML code, 20

20

which is the code that's responsible for loading web pages. 21

21

And as it flows through our computer, 22

22

we can insert any piece of code that we want, 23

23

and the browser will execute this code. 24

24

Now, HTML is only responsible for rendering the elements 25

25

that you see on the web page. 26

26

So it's responsible for the buttons, 27

27

for the forms for the text, 28

28

it doesn't really allow us to do much. 29

29

But modern browsers can execute JavaScript code. 30

30

JavaScript is a powerful programming language 31

31

that we can use to do so many things, 32

32

we can actually modify the whole page, 33

33

remove elements or add elements into the page, 34

34

we can replace links and this is actually 35

35

what I did when I modified the HSTS plugin. 36

36

So I added code that will replace the HTTPS with HTTP. 37

37

And I also added code that will replace 38

38

the actual link the actual domain name 39

39

with this spoof domain name with the one with the dot com 40

40

or to whatever you set it to in the script. 41

41

You can even use it to hooke the browser 42

42

to other browser exploitation frameworks, 43

43

which we can use to further exploit the target 44

44

and even gain full control over their computer. 45

45

And we'll see that later on in the course. 46

46

But for now, I'm gonna show you how to inject 47

47

a very simple JavaScript code into the loaded pages. 48

48

And then we'll build up on that in future lectures 49

49

and see how powerful and useful this can be. 50

50

So right here, I have my Cali machine. 51

51

And before I run better cap and show you 52

52

how to inject JavaScript. 53

53

First of all, we need to have some JavaScript code 54

54

to inject into the target browser. 55

55

So I'm gonna open a text editor. 56

56

And I'm gonna write a very, very simple JavaScript code. 57

57

Like I said, we will see how we can use this 58

58

to run more useful codes. 59

59

But for now, we're keeping this simple 60

60

just to see how we can actually run JavaScript code. 61

61

So all I'm gonna do is alert, open a bracket, 62

62

quotation mark and I'm gonna say JavaScript test. 63

63

I'm gonna close the quotation mark 64

64

and close the bracket and add a semicolon. 65

65

So right here, this code, all it's gonna do 66

66

is it's gonna display a warning message 67

67

and alert message saying JavaScript code. 68

68

So since we're gonna try to inject this code into all pages, 69

69

every time we load a webpage, 70

70

we should see a message saying JavaScript test. 71

71

Now I'm gonna save this. 72

72

So I'm gonna go to file, save, 73

73

and I'm gonna put this in my root directory. 74

74

And I'm just gonna call it alert dot js. 75

75

I'm gonna hit enter and that is saved now in my route, 76

76

so if I quit it, we can see we have the file right here. 77

77

So this is the file that contains the code 78

78

that we want to inject into any webpage 79

79

that loads on the target computer. 80

80

The next step is to go to our HSTS hijack plugin. 81

81

So as I showed you before, this was n-user, 82

82

share better cap caplets, HSTS hijack, 83

83

make sure you use the one that I included in the resources, 84

84

not the one that comes built-in with better cap 85

85

because the built-in one will not work as you wanted. 86

86

So in here we have the HSTS hijack dot cap file. 87

87

This is the configuration file for the whole plugin. 88

88

So I'm gonna right click this and open 89

89

it with my text editor. 90

90

And in here, what we wanna modify 91

91

is the payloads right here. 92

92

So as you can see in here, 93

93

it's already injecting a JavaScript file 94

94

called key logger dot js. 95

95

But we also want to inject our own code. 96

96

So I'm gonna add a comma here 97

97

and I'm gonna add star followed by a colon. 98

98

We added this star right here to say that I want to inject 99

99

my script into any page that the target loads. 100

100

If you want to inject your code into specific domains, 101

101

then you can remove the star and just list the domains 102

102

that you want to inject this code in right here. 103

103

But like I said, we wanna inject this into all pages. 104

104

So I'm gonna put this as a star. 105

105

And after the colon, I'm gonna put the location 106

106

of the JavaScript file that I want 107

107

to inject into the browser. 108

108

So if we look back in here, 109

109

this is the file that we just created, 110

110

which is in route in my home, and it's called alert dot js. 111

111

So I'm gonna put in here, 112

112

I'm just gonna say forward slash route, 113

113

followed by alert dot js. 114

114

And that's it, I'm gonna save this Control+S 115

115

and credit Control+Q, and we are ready to go. 116

116

So I'm gonna go to my terminal, 117

117

I'm gonna run better cap using the exact 118

118

same command that we've been using. 119

119

So we're just giving it the interface as ETH zero 120

120

and we're giving it our spoof file 121

121

to automatically run the ARP spoofing attack, 122

122

putting us in the middle of the connection. 123

123

And as you can see, this is working with not errors, 124

124

so everything is perfect. 125

125

What I also wanna do right now is run my HSTS hijack plugin. 126

126

And as you know, all we have to do is just type HS and tab, 127

127

this will auto complete, I'm gonna hit Enter, 128

128

and everything is running with no errors at all. 129

129

So everything is perfect. 130

130

And as you can see in here, 131

131

it's saying that the payloads, 132

132

it's loading the JavaScript payloads are the key loggers. 133

133

This is the default one that the file already 134

134

was loading and the one that we just specified, 135

135

which is in route alert dot js. 136

136

So now anytime our target loads any web page, 137

137

the whatever code we put in the alert dot js 138

138

should be injected in the loaded page, 139

139

and it should get executed. 140

140

The result of that should show us 141

141

a simple message saying test JavaScript. 142

142

So let's go to the target. 143

143

And as usual, a good idea is just to remove 144

144

the browsing data just to make sure that nothing is cached. 145

145

And I always like to first test with the simplest case, 146

146

and then move on to more complex scenarios. 147

147

So first of all, I'm gonna test it against 148

148

a normal HTTP page, so that there is nothing 149

149

to bypass, no encryption whatsoever. 150

150

So we're just gonna go to vulnweb.com. 151

151

Perfect as you can see, we have an alert message 152

152

in here telling us JavaScript test. 153

153

So basically, this means the JavaScript code 154

154

in my alert dot js file got injected into this page. 155

155

So now that we've verified 156

156

it works against normal HTTP pages, 157

157

let's go ahead and test it against a page that uses HTTPS, 158

158

such as stack overflow.com. 159

159

Perfect, it's working as expected. 160

160

Another example would be linkedin.com. 161

161

Keep in mind, these websites use HTTPS. 162

162

And as you can see, we're able to load them with no HTTPS 163

163

in here, so over HTTP only. 164

164

So even if you log in right here, 165

165

you'll be able to get the username 166

166

and the password as shown before. 167

167

Finally, let's go and test it against the HSTS website 168

168

using the partial HSTS bypass method that I showed you. 169

169

So for that work we'll need to go to Google first of all, 170

170

and we need to go to a Google domain that does not use HSTS. 171

171

Similar to google.ie. 172

172

This is actually the local Google website for Ireland. 173

173

And as you can see, the code works. 174

174

This is fine Google only users HTTPS anyway. 175

175

But let's look for Facebook. 176

176

Now we know Facebook uses HSTS. 177

177

And because HSTS is used, we should not be able 178

178

to inject anything on the website 179

179

because the browser will only load it over HTTPS. 180

180

But using our partial bypass method, 181

181

if I click on Facebook from here, 182

182

as you can see, the code gets executed, 183

183

because what we're loading right now 184

184

is facebook.con, not facebook.com. 185

185

And as you can see, we get a normal Facebook page again, 186

186

that looks identical, and if you log in, 187

187

you'll be able to get the username and the password. 188

188

So as you can see, this work against HTTP 189

189

and HTTPS pages, and even HSTS if the target searches 190

190

for that website, not if they put the domain name in here. 191

191

So if the target comes in and literally types 192

192

facebook.com manually and hit enter, 193

193

the browser will force the HTTPS connection 194

194

as you can see in here, because like I said, 195

195

it has a preloaded list of websites 196

196

that it can only load over HTTPS. 197

197

And because the browser is establishing a HTTPS connection, 198

198

the data will be encrypted 199

199

and therefore we won't be able to inject anything in it.