Original subtitles

1 1

In the previous lecture 2

2

we seen how to downgrade HTTPS websites to HTTP 3

3

and this allowed us to basically see anything a user does 4

4

on these websites because data in HTTP 5

5

is sent in plain text. 6

6

Therefore we were able to see the user names, the passwords, 7

7

the URLs, and anything they do on HTTPS websites. 8

8

At the end of the lecture, 9

9

I also showed you that the method 10

10

will not work against Facebook, Twitter, 11

11

and other websites that use HSTS. 12

12

The reason why it won't work against these websites, 13

13

because modern web browsers come with a list of websites 14

14

that they should only load over HTTPS. 15

15

See what we were doing in the previous lecture, 16

16

whenever a browser requests a website, 17

17

we load that website even if it uses HTTPS, 18

18

but we always give him back the HTTP version. 19

19

In HSTS, the browser knows that this website, for example, 20

20

facebook.com should always be loaded over HTTPS. 21

21

So even before sending this request to us, 22

22

it will always send it in HTTPS 23

23

and it'll always only accept it 24

24

if it comes back as HTTPS. 25

25

So there is nothing we can do really once we become the man 26

26

in the middle because the browser 27

27

is doing this check locally, 28

28

it's checking this against a list 29

29

that is stored on the computer itself. 30

30

Therefore, the only practical solution 31

31

at the moment to bypass HSTS is to make the browser think 32

32

that it is loading another website. 33

33

To do this, we're gonna replace all HSTS links 34

34

in loaded pages to similar links, 35

35

but they're not the same links. 36

36

For example, we can replace facebook.com with facebook.corn. 37

37

Now I know this seems very suspicious, 38

38

but trust me, when it goes into the URL bar, 39

39

the RN here at the middle, 40

40

it'll seem very similar to the M letter. 41

41

Another way of doing this, 42

42

you can replace twitter.com with twiter.com 43

43

but with a single T here instead of a double T, 44

44

I know this sounds a little bit confusing right now, 45

45

but let me go and do it practically 46

46

and you will see how this is gonna work. 47

47

So right here I have my Cali machine 48

48

and we're actually gonna use the HSTS caplets 49

49

that we used in the previous lecture. 50

50

So I've already showed you where to download it 51

51

and where to place it, 52

52

please make sure you use the caplet that I gave you 53

53

in the resources of this lecture, 54

54

not the one that comes with BetterCAP 55

55

because the one that I gave you in the resources 56

56

of this lecture is modified and it contains code 57

57

that will actually replace 58

58

the domain names as shown in here. 59

59

The original one does not contain that code 60

60

so it won't work as I'm gonna show you right now. 61

61

So as shown in the previous lecture, 62

62

I already have my caplet in here 63

63

in user share BetterCAP caplets 64

64

and this is the name of the caplet. 65

65

If we go inside it, we have a file called hstshijack.cap. 66

66

This is the configuration file of the caplet, 67

67

so I'm gonna right-click it, 68

68

I'm gonna open it with other application. 69

69

I'm gonna click on view all applications 70

70

and you wanna pick any text editor that you have. 71

71

So I'm gonna keep this at Leafpad you might have 72

72

to scroll down to find it, but I have it here. 73

73

I'm gonna select 74

74

and as you can see we have a normal text file 75

75

with all the configurations that we can set 76

76

and I've already pre-configured this for you. 77

77

The main things that you wanna understand 78

78

and maybe change is the targets and the replacements. 79

79

So the targets are the domains that use HSTS 80

80

that you want to replace. 81

81

For example, I have twitter.com in here 82

82

and I also have *.twitter.com 83

83

basically when you use a star, 84

84

this is a wild card and it basically means 85

85

any subdomain .twitter.com is a target as well. 86

86

Enter replacement, 87

87

you wanna tell the program what to replace this target with. 88

88

For example, whenever we see twitter.com 89

89

we're gonna replace it with twitter.corn. 90

90

Similar goes for Facebook and Apple 91

91

and a few other domains that I set. 92

92

You can also play around with the obfuscate 93

93

and encode options. 94

94

I've set both of these to false because basically 95

95

what these will do, 96

96

they'll obfuscate the code and encode it, 97

97

but I noticed some browsers like Firefox 98

98

will block obfuscated or encoded code. 99

99

That's why I set both of these to false 100

100

so that the code is left as is. 101

101

Here in the payloads 102

102

you can set any other JavaScript code 103

103

that you want to inject leave this the same, 104

104

we'll talk about JavaScript injection in a future lecture. 105

105

Finally, you wanna make sure that the DNS spoof domains 106

106

are set exactly the same as the replacements in here. 107

107

So I literally copy this line and paste it here. 108

108

Now I'm actually gonna keep all of this the same. 109

109

I don't need to modify any of it, but like I said, 110

110

if you are targeting different websites 111

111

or if you want to use different replacements. 112

112

For example, if you wanted to use a Twitter with a single T 113

113

and keep this .com you can do that here. 114

114

If you wanted to use a Facebook with a single O 115

115

and keep this .com again instead of .corn, 116

116

you can do it here. 117

117

Once done, make sure you save and quit this file 118

118

and we're ready to run the attack. 119

119

So running this attack is actually gonna be identical 120

120

to what we did in the previous lecture. 121

121

You just wanna make sure you modify this file properly. 122

122

So going back to BetterCAP, I'm gonna clear the screen, 123

123

run BetterCAP with the same command, 124

124

loading the spoof caplet so we can do 125

125

all of the ARP spoofing commands 126

126

and run the sniffer all automatically. 127

127

And perfect. 128

128

As you can see, everything is running 129

129

as expected with no errors. 130

130

If you run this and you get an error, 131

131

just do exit and run BetterCAP again. 132

132

Next we wanna run the caplet, 133

133

the HSTS hijack caplet exactly as shown 134

134

in the previous lecture. 135

135

All we have to do is type HS tab, 136

136

it'll auto complete for us and hit enter to run it. 137

137

Again as you can see, no errors, 138

138

so everything is working as expected. 139

139

Let's go to the target machine 140

140

and see how this is going to work. 141

141

So I have my Windows machine right here. 142

142

This is Chrome, the latest version in April, 2019 143

143

and before I do anything, like I said, 144

144

it's a good idea to always just remove the browsing data 145

145

and before I actually load any websites, 146

146

it is very important to understand that even 147

147

with everything that we're doing right now, 148

148

if you try to go to Facebook and type .com at the end here, 149

149

it will not work. 150

150

What we're doing right now will not work 151

151

because Chrome right here has a list that is stored 152

152

on this computer that says do not load facebook.com 153

153

unless it is loaded over HTTPS. 154

154

So if you type Facebook right here like this, 155

155

it will not work. 156

156

The only way we can do this 157

157

is if the user first goes to a search engine. 158

158

For example, google.ie for Ireland and then in Google, 159

159

as you can see, Google doesn't use HSTS, 160

160

so we bypass this using the normal HTTPS bypass 161

161

and then if the user in here searches 162

162

for their target website, for example, Facebook, 163

163

then our script is gonna run in the background 164

164

and it's going to replace all links 165

165

in this page for facebook.com with facebook.corn. 166

166

So if I actually hover over this, 167

167

you'll see in the status bar, 168

168

the website that will be loaded is facebook.corn, 169

169

not facebook.com. 170

170

This is fine here, it still says facebook.com 171

171

but only in the code of the HTML page, 172

172

facebook.com got replaced with facebook.corn. 173

173

So if I click on this link, 174

174

again, as you can see we get a normal Facebook page, 175

175

but if you look here on top, you'll see there is no HTTPS. 176

176

And if you look at the domain name, 177

177

you'll see it says .corn, not .com. 178

178

Again, like I said, you can actually keep this .com 179

179

and use Facebook with one O or you can add an extra O, 180

180

you can be as creative as you want with this. 181

181

This is just an example that I'm giving you. 182

182

Now, once we're here, 183

183

we can login normally with my username, 184

184

so zaid@zsecurity.org and put my password, 185

185

one, two three four five six seven eight nine zero 186

186

hit enter. 187

187

And if we go back, scroll up. 188

188

Perfect. 189

189

As you can see, 190

190

we have the username zaid@zsecurity.org 191

191

and the password all the way up to nine zero. 192

192

Now, like I said, the only way for this to work 193

193

is if the user gets to Facebook through another website 194

194

that does not use HSTS. 195

195

If they go on the URL bar and type facebook.com themselves, 196

196

we will not be able to do this. 197

197

That's why this is considered as a partial solution 198

198

and not a full solution.