Instructor: In the previous lecture 2 2
we seen how to downgrade HTTPS websites to HTTP 3 3
and this allowed us to basically see anything a user does 4 4
on these websites because data in HTTP 5 5
is sent in plain text. 6 6
Therefore we were able to see the user names, the passwords, 7 7
the URLs, and anything they do on HTTPS websites. 8 8
At the end of the lecture, 9 9
I also showed you that the method 10 10
will not work against Facebook, Twitter, 11 11
and other websites that use HSTS. 12 12
The reason why it won't work against these websites, 13 13
because modern web browsers come with a list of websites 14 14
that they should only load over HTTPS. 15 15
See what we were doing in the previous lecture, 16 16
whenever a browser requests a website, 17 17
we load that website even if it uses HTTPS, 18 18
but we always give him back the HTTP version. 19 19
In HSTS, the browser knows that this website, for example, 20 20
facebook.com should always be loaded over HTTPS. 21 21
So even before sending this request to us, 22 22
it will always send it in HTTPS 23 23
and it'll always only accept it 24 24
if it comes back as HTTPS. 25 25
So there is nothing we can do really once we become the man 26 26
in the middle because the browser 27 27
is doing this check locally, 28 28
it's checking this against a list 29 29
that is stored on the computer itself. 30 30
Therefore, the only practical solution 31 31
at the moment to bypass HSTS is to make the browser think 32 32
that it is loading another website. 33 33
To do this, we're gonna replace all HSTS links 34 34
in loaded pages to similar links, 35 35
but they're not the same links. 36 36
For example, we can replace facebook.com with facebook.corn. 37 37
Now I know this seems very suspicious, 38 38
but trust me, when it goes into the URL bar, 39 39
the RN here at the middle, 40 40
it'll seem very similar to the M letter. 41 41
Another way of doing this, 42 42
you can replace twitter.com with twiter.com 43 43
but with a single T here instead of a double T, 44 44
I know this sounds a little bit confusing right now, 45 45
but let me go and do it practically 46 46
and you will see how this is gonna work. 47 47
So right here I have my Cali machine 48 48
and we're actually gonna use the HSTS caplets 49 49
that we used in the previous lecture. 50 50
So I've already showed you where to download it 51 51
and where to place it, 52 52
please make sure you use the caplet that I gave you 53 53
in the resources of this lecture, 54 54
not the one that comes with BetterCAP 55 55
because the one that I gave you in the resources 56 56
of this lecture is modified and it contains code 57 57
that will actually replace 58 58
the domain names as shown in here. 59 59
The original one does not contain that code 60 60
so it won't work as I'm gonna show you right now. 61 61
So as shown in the previous lecture, 62 62
I already have my caplet in here 63 63
in user share BetterCAP caplets 64 64
and this is the name of the caplet. 65 65
If we go inside it, we have a file called hstshijack.cap. 66 66
This is the configuration file of the caplet, 67 67
so I'm gonna right-click it, 68 68
I'm gonna open it with other application. 69 69
I'm gonna click on view all applications 70 70
and you wanna pick any text editor that you have. 71 71
So I'm gonna keep this at Leafpad you might have 72 72
to scroll down to find it, but I have it here. 73 73
I'm gonna select 74 74
and as you can see we have a normal text file 75 75
with all the configurations that we can set 76 76
and I've already pre-configured this for you. 77 77
The main things that you wanna understand 78 78
and maybe change is the targets and the replacements. 79 79
So the targets are the domains that use HSTS 80 80
that you want to replace. 81 81
For example, I have twitter.com in here 82 82
and I also have *.twitter.com 83 83
basically when you use a star, 84 84
this is a wild card and it basically means 85 85
any subdomain .twitter.com is a target as well. 86 86
Enter replacement, 87 87
you wanna tell the program what to replace this target with. 88 88
For example, whenever we see twitter.com 89 89
we're gonna replace it with twitter.corn. 90 90
Similar goes for Facebook and Apple 91 91
and a few other domains that I set. 92 92
You can also play around with the obfuscate 93 93
and encode options. 94 94
I've set both of these to false because basically 95 95
what these will do, 96 96
they'll obfuscate the code and encode it, 97 97
but I noticed some browsers like Firefox 98 98
will block obfuscated or encoded code. 99 99
That's why I set both of these to false 100 100
so that the code is left as is. 101 101
Here in the payloads 102 102
you can set any other JavaScript code 103 103
that you want to inject leave this the same, 104 104
we'll talk about JavaScript injection in a future lecture. 105 105
Finally, you wanna make sure that the DNS spoof domains 106 106
are set exactly the same as the replacements in here. 107 107
So I literally copy this line and paste it here. 108 108
Now I'm actually gonna keep all of this the same. 109 109
I don't need to modify any of it, but like I said, 110 110
if you are targeting different websites 111 111
or if you want to use different replacements. 112 112
For example, if you wanted to use a Twitter with a single T 113 113
and keep this .com you can do that here. 114 114
If you wanted to use a Facebook with a single O 115 115
and keep this .com again instead of .corn, 116 116
you can do it here. 117 117
Once done, make sure you save and quit this file 118 118
and we're ready to run the attack. 119 119
So running this attack is actually gonna be identical 120 120
to what we did in the previous lecture. 121 121
You just wanna make sure you modify this file properly. 122 122
So going back to BetterCAP, I'm gonna clear the screen, 123 123
run BetterCAP with the same command, 124 124
loading the spoof caplet so we can do 125 125
all of the ARP spoofing commands 126 126
and run the sniffer all automatically. 127 127
And perfect. 128 128
As you can see, everything is running 129 129
as expected with no errors. 130 130
If you run this and you get an error, 131 131
just do exit and run BetterCAP again. 132 132
Next we wanna run the caplet, 133 133
the HSTS hijack caplet exactly as shown 134 134
in the previous lecture. 135 135
All we have to do is type HS tab, 136 136
it'll auto complete for us and hit enter to run it. 137 137
Again as you can see, no errors, 138 138
so everything is working as expected. 139 139
Let's go to the target machine 140 140
and see how this is going to work. 141 141
So I have my Windows machine right here. 142 142
This is Chrome, the latest version in April, 2019 143 143
and before I do anything, like I said, 144 144
it's a good idea to always just remove the browsing data 145 145
and before I actually load any websites, 146 146
it is very important to understand that even 147 147
with everything that we're doing right now, 148 148
if you try to go to Facebook and type .com at the end here, 149 149
it will not work. 150 150
What we're doing right now will not work 151 151
because Chrome right here has a list that is stored 152 152
on this computer that says do not load facebook.com 153 153
unless it is loaded over HTTPS. 154 154
So if you type Facebook right here like this, 155 155
it will not work. 156 156
The only way we can do this 157 157
is if the user first goes to a search engine. 158 158
For example, google.ie for Ireland and then in Google, 159 159
as you can see, Google doesn't use HSTS, 160 160
so we bypass this using the normal HTTPS bypass 161 161
and then if the user in here searches 162 162
for their target website, for example, Facebook, 163 163
then our script is gonna run in the background 164 164
and it's going to replace all links 165 165
in this page for facebook.com with facebook.corn. 166 166
So if I actually hover over this, 167 167
you'll see in the status bar, 168 168
the website that will be loaded is facebook.corn, 169 169
not facebook.com. 170 170
This is fine here, it still says facebook.com 171 171
but only in the code of the HTML page, 172 172
facebook.com got replaced with facebook.corn. 173 173
So if I click on this link, 174 174
again, as you can see we get a normal Facebook page, 175 175
but if you look here on top, you'll see there is no HTTPS. 176 176
And if you look at the domain name, 177 177
you'll see it says .corn, not .com. 178 178
Again, like I said, you can actually keep this .com 179 179
and use Facebook with one O or you can add an extra O, 180 180
you can be as creative as you want with this. 181 181
This is just an example that I'm giving you. 182 182
Now, once we're here, 183 183
we can login normally with my username, 184 184
so zaid@zsecurity.org and put my password, 185 185
one, two three four five six seven eight nine zero 186 186
hit enter. 187 187
And if we go back, scroll up. 188 188
Perfect. 189 189
As you can see, 190 190
we have the username zaid@zsecurity.org 191 191
and the password all the way up to nine zero. 192 192
Now, like I said, the only way for this to work 193 193
is if the user gets to Facebook through another website 194 194
that does not use HSTS. 195 195
If they go on the URL bar and type facebook.com themselves, 196 196
we will not be able to do this. 197 197
That's why this is considered as a partial solution 198 198
and not a full solution.