Instructor: Now everything that we did so far 2 2
will only work against HTTP pages. 3 3
The reason why it works against HTTP 4 4
because as we've seen the data and HTTP 5 5
is sent as plain text. 6 6
So it's text that humans like us can read and understand. 7 7
That's why when we are the man in the middle 8 8
we are able to read this text. 9 9
And if we wanted 10 10
we are able to modify this text as we wish. 11 11
Now this is obviously a problem 12 12
and this problem was fixed in HTTPS. 13 13
So as you know most websites use HTTPS 14 14
the reason why, like I said 15 15
because it's a more secure version of HTTP 16 16
and basically the way it works is 17 17
it adds an extra layer over HTTP 18 18
which is where the S comes from. 19 19
So it's a secure HTTP protocol 20 20
and this extra layer will encrypt 21 21
the plain text data that HTTP sends. 22 22
So if a person manages to become the man in the middle 23 23
they will be able to read this data. 24 24
But the data will be gibberish, 25 25
it will not be readable 26 26
to the person intersecting the connection. 27 27
Now HTTPS relies on TLS or SSL 28 28
to encrypt the data., 29 29
and this is every difficult to break. 30 30
Therefore in order to by pass this 31 31
the easiest method is to downgrade 32 32
HTTPS connections to HTTP. 33 33
So since we are the man in the middle 34 34
we can check if the target is requesting a HTTPS website. 35 35
And instead of giving him the HTTPS version of that website 36 36
we will give him the HTTP version. 37 37
This way the data will be sent in plain text, 38 38
and we will be able to read it exactly as I showed you 39 39
in the previous lecture. 40 40
To do this we'll have to manually configure 41 41
and use a tool called SSL Strip. 42 42
And I show how to do this is my more advanced courses. 43 43
But luckily BetterCAP has a caplet 44 44
that will do all of this for us. 45 45
The only problem is this caplet does not replace 46 46
all HTTPS links to HTTP 47 47
in the loaded pages. 48 48
So I modified this caplet for you 49 49
to make sure that it's gonna work as expected. 50 50
And I've included it in the resources of this lecture. 51 51
So all we have to do is download the zip 52 52
in the resources of this lecture 53 53
and I have it downloaded in my Kali machine. 54 54
So I'm gonna go to my files and to my downloads. 55 55
And I have it right here. 56 56
It;s called hstshijacked.zip. 57 57
I'm gonna right click it and extract it here. 58 58
This is the folder of this caplet, 59 59
and I'm gonna copy it 60 60
and paste it in the correct location, 61 61
where BetterCAP loads caplets from. 62 62
So to go to that location, 63 63
you can either press Control and L on your keyboard 64 64
to open the Path Bar, or you can press here 65 65
and press forward slash again to open the Path Bar. 66 66
Once the Path Bar is open 67 67
we wanna go to USR, 68 68
share, 69 69
BetterCAP, caplets. 70 70
So like I said this is the default location 71 71
where BetterCAP stores all of the caplets. 72 72
I'm gonna hit Enter 73 73
and as you can see we already have this caplet in here 74 74
but like I said this caplet is buggy, 75 75
it doesn't work as expected. 76 76
So I'm gonna delete it. 77 77
So right click, move to Trash. 78 78
And I'm gonna paste the one I just copied in here. 79 79
So that's it, we're good to go. 80 80
We can go ahead and use this caplet from BetterCAP. 81 81
But before we do that, 82 82
I also want to go to my home directory, 83 83
this is where I stored the caplet that we created 84 84
in the previous lecture. 85 85
The spoof caplet, 86 86
the one that will run the ARP spoofing command. 87 87
And then run the sniffer. 88 88
I just wanna modify one thing in this. 89 89
So I'm gonna right click it, and open it with Leafpad. 90 90
And what I wanna modify is, 91 91
I want to add an option to the sniff in here. 92 92
So as you know the line net.sniff.on 93 93
will turn on my sniffer, 94 94
but before turning it on, 95 95
I want to set the net.sniff.local to true 96 96
and what this option will do 97 97
it will tell BetterCAP to sniff all data 98 98
even if it thinks this data is local data. 99 99
The reason why I set this option to true 100 100
because once we use the HTTPS bypass caplet 101 101
the data will seem as if it is being sent from our computer. 102 102
So BetterCAP will think these passwords belong to me, 103 103
to my computer and it will not display it to me on screen. 104 104
That's why we are setting it to true. 105 105
So that we can see all of the usernames and the passwords 106 106
sent on the websites that we will downgrade 107 107
from HTTPS to HTTP. 108 108
So I'm gonna save this. 109 109
Control + S and quit it, Control + Q. 110 110
And now we are actually ready to go and use this caplet. 111 111
So in the next lecture, 112 112
I'm gonna show you how to use this caplet 113 113
to downgrade HTTPS connections to HTTP. 114 114
And therefore be able to sniff the URLs, 115 115
the login information and passwords 116 116
that people enter on websites 117 117
that use HTTPS by default.