Instructor: In the pervious lectures, 2 2
we learned how to detect ARP spoofing attacks 3 3
by manually analyzing the ARP tables. 4 4
We also learned how to install tools 5 5
such as Xarp to automatically detect ARP spoofing attacks 6 6
without having to manually check the ARP tables 7 7
and we even learned 8 8
how to detect other suspicious activities using Wireshark. 9 9
Now, this is really good but still has a few problems. 10 10
First of all, we're only talking about detection, 11 11
so even when we detect that someone 12 12
is intercepting the connection, 13 13
we can't really do much, 14 14
all we could so is simply disconnect 15 15
from the network, maybe change its password if we can, 16 16
if we're on the network to something that's more difficult 17 17
or if this is a public network 18 18
such as a airport, a hotel or a college network, 19 19
then all we can do is simply just disconnect 20 20
and use a different network 21 21
because we can change its password. 22 22
The other problem with the previous methods, 23 23
like I said, they're only detection methods, 24 24
therefore they'll only work if the target manage 25 25
to become the man-in-the-middle using ARP spoofing. 26 26
But what if someone is able 27 27
to intercept the connection using another method? 28 28
For example, if someone is running a fake access point, 29 29
like I showed you earlier, 30 30
and you connected to this fake access point? 31 31
Or if you connected to a hotel, a college, 32 32
a public Wi-Fi network, a cafe network 33 33
and the admin of that network 34 34
is actually collecting data or someone 35 35
or a hacker gained access to the admin's computer 36 36
and again is analyzing the data 37 37
because by default, in fake networks 38 38
and in any network, 39 39
the admin is able to see the traffic 40 40
because the traffic will have to go through their server 41 41
or through their router. 42 42
So the detection methods 43 43
that I showed you earlier won't even work against this. 44 44
Therefore, in this lecture, 45 45
I wanna discuss two solutions to this problem 46 46
so the idea is you use these solutions 47 47
if you discover that you're being attacked 48 48
or if you're connecting to a network 49 49
that you don't own and manage yourself. 50 50
So if you're connecting to a college network, 51 51
an airport network, a cafe network, 52 52
or any other network 53 53
that you yourself don't have control over. 54 54
The solution to all of this 55 55
is to encrypt your traffic. 56 56
If you encrypt your traffic, 57 57
we don't really care if somebody is able 58 58
to intercept this traffic 59 59
because our traffic is going to be encrypted, 60 60
therefore it'll be gibberish 61 61
and it won't be useful to anybody 62 62
that is intercepting our traffic. 63 63
So there are a number of ways to so this 64 64
and I'll explain how they work as we go through it. 65 65
So let me show you this in action. 66 66
Right here, I'm already running Bettercap 67 67
and as you can see, it's already getting information. 68 68
And right here is my target 69 69
and we're already on Vulnweb 70 70
and if we just click on anything just to show you, 71 71
you'll see the domain is gonna be detected in here. 72 72
And then let's just quickly log in. 73 73
You'll see this login attempt will be detected 74 74
so we have the username is admin 75 75
and the password is testtesttest. 76 76
Again, if we try, I'll just open a new tab 77 77
and go to Stack Overflow, 78 78
you'll see it'll load over HTTP, not hTTPS, 79 79
so again, if I go ahead and log in, 80 80
I'll be able to log in and detect the password 81 81
and the HSTS method that I showed you earlier, 82 82
again it'll work and we'll be able to bypass that 83 83
and steal the password. 84 84
So right, this Kali machine 85 85
is able to intercept all the data 86 86
that is sent to and from my Windows machine right here. 87 87
So the first method to prevent these attacks 88 88
and we don't care if we're being attacked, 89 89
again, I'm not running Xarp, I'm not managing my ARP tables, 90 90
I don't care if someone intercepts my data. 91 91
Wheat I'm gonna do is I'm gonna install a plugin 92 92
on my browser called HTTPS Everywhere. 93 93
So I'm gonna be installing it on Firefox. 94 94
I'll include its link in the resources of this lecture, 95 95
but there is an equivalent of this plugin 96 96
for most browsers such as Chrome and others. 97 97
All we have to do is simply click on Add to Firefox 98 98
or Add to Browser, whatever browser you use. 99 99
We're gonna click on Add in here. 100 100
And that's it, the plugin is added in here. 101 101
As you can see, I'm gonna click on OK 102 102
and we can manage it here from its icon on the top right. 103 103
So as you can see right here now it's set to off 104 104
and if I click this, 105 105
I will turn on this plugin 106 106
and basically what this plugin will do, 107 107
you can think of it as if it adds HSTS support 108 108
to more websites, pretty much to any website 109 109
that uses HTTPS. 110 110
Therefore, for example, 111 111
when I try to access stack Overflow in here, 112 112
I was able to downgrade it 113 113
because my browser does not know 114 114
that this website should be loaded over HTTPS 115 115
and Bettercap was downgrading the HTTPS requests to HTTP 116 116
like I explained in previous lectures. 117 117
What this plugin will do, 118 118
similar to HSTS, it has a list of websites 119 119
that support HTTPS 120 120
and therefore when we try to downgrade the HTTPS connection 121 121
of this website to a HTTP connection, 122 122
it'll tell the browser no, don't do that 123 123
and it will upgrade it again back 124 124
to a HTTPS connection. 125 125
So let me show you. 126 126
I'm just gonna delete the history 127 127
and I'm gonna load Stack Overflow again 128 128
and perfect, as you can see, 129 129
it's loading with HTTPS in here. 130 130
Therefore now if I go and log in, 131 131
my information will be encrypted and therefore the hacker 132 132
won't be able to see my username and password. 133 133
So that's really, really good 134 134
but not perfect. 135 135
Let me tell you why it's not perfect. 136 136
First of all, if we go back to a HTTP website, 137 137
again similar to what we have in here in Vulnweb, 138 138
so I'm just gonna log out 139 139
and we'll log in again with another password. 140 140
I'll just put the password now to 1234567890. 141 141
We'll log in 142 142
and if we go back here to the logs, 143 143
all the way down, you'll see we are still able 144 144
to detect the username and the password. 145 145
So this plugin is really good for websites 146 146
that support HTTPS. 147 147
It'll force us to load HTTPS on websites 148 148
that support HTTPS 149 149
but if you access a website that only uses HTTP 150 150
such as Vulnweb, I know there aren't a lot 151 151
of websites that do that 152 152
but they still exist, so if you access any website 153 153
that uses only HTTP, then that website is still open 154 154
to the hacker. 155 155
So the hacker can still see this information, 156 156
they'll still be able to steal usernames and passwords. 157 157
If you send usernames and passwords to them. 158 158
Not only that but they will also still be able 159 159
to replace downloads, serve you fake updates 160 160
or inject JavaScript code like we've seen earlier 161 161
and get you hooked to Beef. 162 162
HTTPS Everywhere also does not prevent the hacker 163 163
from seeing the websites that you access 164 164
and running DNS spoofing attacks. 165 165
Let me show you. 166 166
So if I just go to bing.com, for example, 167 167
and then let's go to duckduckgo.com, 168 168
keep in mind, HTTPS Everywhere is still working 169 169
and let's go to the hacker machine 170 170
and just look at our logs. 171 171
So as you can see, we can still see that our target went 172 172
to DuckDuckGo, we can see that the target went to Google. 173 173
We can see that the target went to Bing, 174 174
so we can still see the domain names 175 175
but we can see the data that gets sent 176 176
because that'll be encrypted with HTTPS 177 177
so there is still some data that the hacker is able to get. 178 178
If you want to take your security to the next level 179 179
and completely encrypt everything you send and receive, 180 180
then you should think about using a VPN. 181 181
Therefore, in the next lecture, 182 182
I'll explain to you what a VPN is, how it works, 183 183
and how it can protect us from hackers 184 184
or anybody that intercepts our connection.