All right, guys.
Bye.
Come back.
In the last video we have talked about the theory part.
So we set up a method in the middle proxy and also talked about the IP table rule to forward these packages.
But in this video we do now finally be hands on exercise regarding through the theory part.
Okay, let's go.
Let's switch back to the Ubuntu VM and then establish this man in the middle set up and start intercepting
our man in the middle in our smartphone.
Let's go.
All right.
So here we have the Ubuntu VM.
Now let's talk about the man in the middle proxy first.
In my case, I'm a fan of tool one is the burp suite which we are going to download and install right
now.
And the other one is the man in the middle proxy.
So sometimes the burp suite has some, let's call it strange behavior.
For example, there's no issue regarding to TLS 1.3 on mobile smartphones also sometimes regarding to
other HTTPS connections.
So in case if you patch the certificate pinning but the burp still records in intercepting the traffic,
we might want to try out the other proxy, which is the man in the middle proxy.
Most of the time I'm using the burp suite and it's really amazing tool.
Therefore, let's go.
Let's download it.
We open a new window and this time an incognito window.
So we are absolutely stealth right now.
If you write correctly, then you also can see the spots with a link over here.
So posts we.
These are the main authors of this amazing tool.
So if you click on this link, we end up in using the burp proxy, but I guess we cannot download it
over here.
So no, that's just the documentation.
You can find the download link within products.
And then we can see three additions of the Burp suite.
This one deposit community edition.
This is the one we want to use because this is free and it's really amazing.
It just does not have some features which are not required in this course.
Over here, for example, the professional has a scanner in there, which is also super handy if you
perform a lot of weapon testing.
So the scanner is automatically scanning some sub requests you put into this for scale interactions.
Local file inclusions, small entity injections, the typical August top ten, the Burp Suite, Enterprise
Edition.
I'm not 100% sure about this one.
I guess this is regarding to lab scaling applications.
So if you want to analyze tons of web applications, I guess the Burp Suite Enterprise Edition is the
product to do this.
But yeah, I guess that's regarding to company.
So if a company constantly want to scan their assets, they are web applications, then this might come
handy.
Nevertheless, what we are interested in is the purpose free community edition that's free and it's
really amazing tool which cuts all the stuff we need right now.
So let's download this one over here.
We select WebSphere Community Edition Linux 64 and we hit the download button.
Now we can see the download might take a while and I will come back after this has been finished.
So welcome back.
We're close to finish this download and there we go.
We also have this transition.
This type of fire can harm your computer.
Why?
Because it's in their script and this can execute code.
I trust pot's figure, but nevertheless, let's have a look into this file before we run this.
Therefore, let's say key.
All right.
And let's open new terminal within downloads.
We now take a look at this file.
It might take a while until it has been loaded.
There we go.
Because, I mean, it's loading 200 Mbps into right now.
So at the beginning.
No, we are not at the beginning.
I guess we are in the middle of this file.
There we go.
Now we at the beginning.
Yes.
So here you can see some comments and some code.
The structure looks identical regarding to the other versions I have already analyzed, but nevertheless,
let's step through this a little bit.
Of course, feel free to do a more deep analysis on this one.
If you do not trust it right now, that's never a bad idea.
All right.
Here.
We've got some search.
So.
It's using some Java runtime environment.
Unpicking Cherry, so it seems to maybe bring its own runtime.
I'm not sure about this one.
And here we have a bunch of binary.
So I guess that's the Java package in there.
I mean, we can analyze this by extracting this one and have a look at the magic bytes.
So the file header to figure out what type this over here does, sorry is.
But for me right now it looks okay.
So it looks exactly the same like the other versions maybe.
Let's go to the end of this file.
Here we are now at the end and.
Yeah.
All righty.
So after doing our very deep and trustworthy analysis on this one, let's run this file.
We can see it's being grey or white, however you call this colour.
We need to make it executable and therefore we do this with change mode.
Set the executable flag for this file over here.
If we now do an s again.
There we go.
We can now see the community edition has been set to green so we can now run the special script.
And therefore I would suggest and let somebody run it.
So it seems like I have corrupted this file by saving it.
So if this also happens for you, then sorry for this one.
I need to redownload it real quick.
All right, so I downloaded it once again.
I checked it, and now let's make it executable and run it.
Okay this time.
It seems to work right now.
So by saving it with vim, I maybe have inserted some characters, and this might have caused some trouble
in this file over here.
Okay.
So here's the installation wizard.
So the first one, we get some information, so we only can click next and now we can choose the location
where we want to insert this burp suite.
In my case, I'm using the tools directory.
This one over here.
And towards Bob's community.
And then next, yes, it can create some some links.
And now extracting those files.
Then we've got this just finished.
The burp suite has been already installed.
There wasn't much of a visual task for this one, so let's have a look.
Within tools, we've got an Audi burp suite community.
And here we have now.
Yes, I guess that's in a runtime environment.
We have now the burp suite as a standalone char, so we can run Java Dash and then burp suite or we
can use this one over here.
I guess that's all it's on bash script.
Let's have a quick look.
Yeah.
That's awesome.
So this one starts, Nipper.
All right, we can run this because we.
We have trusted the installation part of this instance.
Therefore, we can also now trust this final one here.
Now we start the burp suite and we can see the pop up here.
And yeah, here we have now the entry point of the burp suite.
Within the community addition, we unfortunately cannot select the project.
So having a project is super nice.
You can store all your requests and responses from your network requests over there.
In our case, we can only work on a temporary project, which means if we close the burp, these files
has been gone, but we can save them.
So it's just a little bit more complicated, but we can also deal with this.
It's not a required feature for us right now.
Then we simply click next.
Here we can save and restore some configuration settings, but we haven't made any yet.
We hit next once again and now the suit starts.
There we go.
That's the purpose of it.
And if you look at this for the first time, it's a little bit overwhelming.
So we can easily fill a two day course.
Just talking about the burp suite and all there feature in there.
It's really ridiculous how much they is possible.
But for now, let's keep it simple.
This video is regarding to setting up or re-establishing our man in the middle connection as fast as
possible.
Therefore, let's only focus on the main part.
Nevertheless, let's talk about a little bit about these features.
So on top over here we've got live passive crawl from proxy.
The traffic that passes through our burp will be automatically analyzed, but not regarding to vulnerabilities
and just regarding to creating some site maps.
Structure about the application vulnerabilities are possible in the purposely pro version over here.
So there's also some kind of scanner which scans those web service requests for SQL injections or as
command injections, XML entity interaction, all the stuff.
We do not need the pro version in our course right now.
Therefore, we can also simply click this away.
Now it's a little bit more clear.
The most important window is the event lock, because here we can see if something goes wrong in the
burp suite.
And this window helps us a lot in identifying the root cause of it.
All right, so now we want to set up our proxy.
What do we need to do so we can find this within proxy and within options?
Over here.
Here we have now the proxy listener and the burp suite.
Default runs on the local host, which is 172127 this way, zero zero of 1.88.
That's the default location for the proxy to run in our case right now, we need to change this because
the interface very perhaps we should listen on should be our man in the middle setup.
So the USB two Ethernet adapter and therefore we have to select the interface which is providing this
adapter which is provided by this adapter.
What this way.
And we can select this simply by going into edit.
Specific address and tip.
You can now select this interface if you have enabled it.
In my case, it's unplugged right now, so let's see how fast we can reestablish this man in the middle
connection.
Therefore, let's make a test.
So by performing an watch we are executing this command every 2 seconds so we can see it's executing
if config and then within 2 seconds this window refreshes.
By having this, we can now count how fast it takes.
Two to re-establish this connection.
I bet it's under 5 seconds, so let's go in 3 to 1.
There we go.
Six.
I guess it was a little bit more, maybe 7 to 8 seconds.
So you got me on this point, but we can see it was still super fast right now.
All right.
Now we've got this interface enabled.
If you go back into our suite and hit edit button again, we can see this interface now is selectable.
So we click on specific address and we select our interface over here.
Now we can see this one changes.
And within the dashboard we've got this orange highlight.
If you click on this one, we can see the screen is now listening on this phone over here.
Regarding to the timestamps, I mean, this could be a little bit better, but yet we see it over here
that the interface has been set up correctly.
All right, so the burp suite is running.
Let's check if our IP for what has been enabled.
We can do this by opening in new terminal and then we print out the content of proc this net IPV four
ip underscore forward.
Yes.
In my case I've gotten one in there, which means IP forwarding has been enabled.
If this is not the case for you, you need to enable it by the following command so we can simply print
out this number one, like this one over here, and then we write it into this file.
So this is how we can enable IP.
For what?
I will show this to you.
So let's say we write this zero in there.
This means IP forwarding will be disabled.
If we now print out the content of this file, then we go.
It has been disabled right now, so let's repeat it with one.
There we go.
It has been enabled back again.
Okay, so second part has been also finished.
The IP forwarding has been enabled.
This means these packages can be forwarded from one interface to the other.
Alrighty.
So next we connect our smartphone, this one over here to our access point that we have successfully
established our man in the middle connection.
So we can do this if we close it over here and then we use screen copy.
There we have the screen and we can see it has been already connected.
But let's make sure that it's connected to the correct wi fi because sometimes it's connecting to your
home wi fi.
If you have, insert the credentials for this one and then you will stare at your screen and wonder
why your man in the middle setup is not working.
So let's go into settings.
And within by five we can see.
Yes, it has been connected to our PTP access point.
Okay, cool.
Then let's recap it a little bit.
IP forwarding enabled men in the middle proxy has been set up.
Men in the middle set up has been set up.
So now we should be able to observe the traffic of our smartphone in Wireshark at least.
Let's check if this one is working.
So we open Wireshark.
We select a USB to Ethernet adapter.
India.
Now, let's create some some map requests.
We go into the Incognito tab and then let's open a web page like example dot org, example dot org.
So here we can see the request has been made and within Wireshark over here we can also see this.
This request has been sniffed.
Let's verify this.
Here's the get request regarding to example dot org.
We can also right click follow TCP stream and then we see the whole TCP stream, our get request and
also the response which comes back from this one over here.
All right.
Nice.
So now it's the question how can we forward this package to our speed intercept and manipulate it?
And the missing piece right now is our IP table rule.
So if we go back into our burp suite over here.
Then we can see we've got it listen or set up on the interface, but we are not forwarding any package
to this one right now.
We would see this within the HTTP history.
So on the proxy HTTP history, there will be our requests if we would have sniffed some.
Right now let's establish this IP table rule and yeah, let's figure out if it's working.
So we open new terminal and we need root privileges for this one.
All right, first task done.
So now let's take this chance and talk about this command once again.
So we want to establish a new IP table rule and therefore IP tables.
The first thing is we have to select our table.
We've got filtering not and mangle.
In our case, we want to switch out the IP addresses of a package.
So we want to reroute this package and this can be done within the table, not the network address.
Translation.
All right.
Next, we want to append a new rule into this table.
We can do this by inserting a capital A and then we want to add a new pre routing rule.
And this means if the package arrives at the interface, we want to reroute it, not to redirect destination
to example dot org.
We want to reroute it to our burp suite and so therefore we append a new pre routing route.
There we go.
Now we do not want to forward every package.
We only want to forward HTTP requests, which means only packages which are regarding to the type TCP.
And this would also include a lot of other stuff like s, h, telnet, ftp and more therefore therefore
also just limited on packages which has a destination port eight.
So the port destination port is or has been set to 80.
And these are the type of packages we want to re for what we can do this by switching out the destination
address of this package and this can be done with this parameter dash chain D nat so we want to switch
the destination address instead of example, talk to the destination 1040 20.1.88 and this is where
our burp suite is listening at right now.
All right, so this is the whole command reroute every package regarding to TCP port eight and switch
to destination address via the NAT Destination Network address translation to whatever it is right now
to our burp suite proxy.
And this will mean every package that arrives at any interface.
So at our use P two Ethernet adapter and also the the NAT adapter of our Ubuntu VM.
If these packages meet those requirements, they will be forwarded to the Bernstein.
Hit Enter and we are good to go.
We can also verify that this IP table rule now exists by typing in IP tables that we and capital.
And then I guess we also need to add the table where we want to list the existing roles right now.
So our table is not there we go.
Now we can see that our IP table rule and it has been inserted over here.
Okay, nice.
Let's clear this one here and now.
If we now perform an HTTP request instead of going through the whole network, it should stack a DBA
suite and let's verify this.
So here's our smartphone, but this application or this request might has been cached.
Therefore, what we need to do is we need to clear the history.
For history.
Okay.
Nothing in there.
And we also should close the tap.
So let's simply make a new tap, new incognito tap.
This should work right now.
So we type in http example dot org.
And now we can see nothing happened because this site has been still cached.
Maybe let's close this hole, this whole Chrome browser, and opening it once again.
Okay.
So I have reopened this browser.
Let's type it in http example dot org.
There we go.
Now it's working before the site simply has been cached and yet the smartphone is reusing the cached
version instead of asking it once again.
But now we can see example dot org.
But this is not the content of example dot org.
This is the content of our burp suite community edition.
So that's nice because our setup works, but this is not something we want to have, right?
If we close this one over here, we can see or we cannot see the request over here.
And also the interceptor doesn't has intercepted anything right now.
The reason for this one is the burp suite is not running as an invisible proxy, which means we've got
now in dead end at our burp suite.
The above suite is not re forwarding these packages and therefore they just get terminated at the burp
suite.
So to enable invisible proxy, we need to go into proxy options and then within our interface over here
we need to click edit.
And then request handling.
Yes.
There we have now this option support invisible proxy and also the hint only enable if you need this
really in our case, we need it because we want to reformat or reroute those packages afterwards.
So by enabling it.
And then observing it over here, you can see this invisible button or this invisible tech has now been
checked.
Now, the purpose of it is running as an invisible proxy.
Let's open the smartphone here once again.
Let's close this top because I mean, it's still cash.
All right, let's open a new Incognito tab.
And now let's open HDPE example once again, and we can see there was something flashing on our screen
and we can see some orange highlights over here.
So within the proxy, the intercept button over here wants to tell us something.
And if we go into this, we can now see that the get requested smartphone is making it stops at the
BRB and we can also observe that the webpage over here is not loaded because we have passed this request
in our purposes right now.
If we hit the forward button, the request will be surfed to the original page to example dot org,
and the response will come back to the smartphone.
So if we open match on the screen once again, we can see.
Yes, we have now this page over here.
Let's keep it in foreground that we can see it next time, all the time.
All right.
So the speed is working within HBX history.
We can now see the request that the smartphone has been made here.
We've got get example dot org and here we've got the response from the server.
So the title is example domain.
If we scroll down, we've got the text which is displayed over here.
Nice.
So how can we modify this package right now?
Well, modify the intercept has been already possible.
So we have seen the intercept or the request stops at our burp suite and we could now modify this one
over here the next time.
But what's even more funny is modifying these responses over here, because that's a text that's being
displayed on the smartphone.
So how can we do this?
The burp suite doesn't intercept responses, which comes from the server in a default mode.
So we have to tell this the burp to do so, and we can do this by going into proxy options and then
we find here intercept client requests.
These are the rules which intercept client requests.
We can also see by having this rule over here, the burp suite is not intercepting requests which are
regarding to pictures.
Otherwise every picture requests would stop at the burp end.
Here we have to forward it manually.
This would be super annoying.
Therefore this is an default rule in the burp suite with intercept server responses we can now define
a new rule.
So.
First of all, we have to select this yet this checkbox over here.
And then we apply a new rule, which is an order condition.
So this means whatever is within our existing rules that over here also now intercept responses which
are regarding tool.
And now we have a lot of select options over here.
And to fetch pretty all of them.
I would suggest any header that matches.
In response matches this record are expressions.
So this means if the response contains any header, then the response will pass at our burp suite.
And this should affect, I guess, every response package right now regarding to HTTP at least.
All right, let's apply this.
Let's go back into intercept and now let's do this once again.
So maybe let's try if the site hasn't been cached any more.
So let's simply repeat this request over here.
If we click forward, then we can see it still has been cached because the web server is answering but
not modified.
If we hit forward then we can see okay, nothing happens anymore.
All right.
Therefore, maybe let's also close this one here.
And reopen it.
And now let's ask once again http example dot org.
All right.
To avoid caching, we can also manipulate some headers over here, for example, user agent, timestamps
and things like this so that the server doesn't recognize this device anymore.
But for now, let's try it.
We forward this one and here we go.
The server now thinks this is a new device or the the cache has been too old to provide a new content
to this device.
Here we have now the response from the server and this also poses a burp suite.
So let's go into this and let's modify this.
Here we have, for example, example domain and let's change this.
Your device has been hacked.
And now also here, maybe let's adjust this text over here.
Ooh, that would be pretty bad, right?
Okay.
And now we can forward this request in the smartphone.
Thinks that this is the request or the sorry, the response the smartphone brings, that this is the
response which comes from the server.
So if you followed this one here, the smartphone is now displaying this amazing text.
So, yeah, your device has been hacked and this would be pretty bad, right?
So this is how we can tamper, inspect, modify, play with network requests.
But just regarding to HTTP and let's perform this one HTTP request.
So let's see where the difference is in between those two protocols.
Therefore, let's talk to The Intercept on.
And then let's open a https example dot org.
Now let's see what happens if you're opening https websites.
So for now it doesn't seem to do anything right.
Also, the burp suite doesn't intercept this request right now.
So why?
The reason for this is we are only forwarding packages that has a destination port 80.
If you want to also mine in the middle https traffic.
We need to apply a different destination.
Port https is regarding to the destination port.
Do we know this?
Absolutely correct.
No matter what you have answered right now, the destination port is for three.
So if you go back into our app table rule, you can simply search in our existing command by hitting
the control button and then typing IP tables and then hitting control are once again.
Then we can browse through our history of our commands over here, which is a very nice feature.
Then we can simply select this by using the upper right key button over here.
So then we can see it transitions to our to our command over here.
All right.
So now we are only forwarding HTTP requests.
If you want to also have HTTPS, we now can simply add this new rule regarding to this destination port.
All right.
If we now go into our view again, we can now see we have two entries in there regarding two destination
port eight and four, four, three.
And that's the amazing thing about this.
Men in the middle set up over here.
So for example, if you want to add additional ports, as is H, but not Telnet, but still we want
to have FTP.
We can play around this and add those ports.
Yeah.
To single locations.
We can also refer them to other proxies.
For example, if you want to deal with Telnet or FTP and if it is not able to handle those protocols,
we can redirect them to another proxy which is freaking awesome.
Right.
All right.
So this set up, I mean, it's just amazing.
And now by simply adding it, this role, once again, we are now also forwarding HTTPS traffic if we
close this one or minimize, minimize this one.
I keep practicing this word and maybe at the end of this course I'm able to pronounce it.
So now if you're opening this once again and let's see what happens.
All right.
Nothing, because it has been cached.
So let's close this one over here.
And yet you might think that's a little bit annoying, but this is what we have to deal.
If we if we analyze web traffic, we need to be sure or we need to figure out what's happening.
And if we do not intercept requests over here, this might be regarding to to in application.
And this can ruin your day if you're looking for errors in your setup over here.
If this page simply just has been cached and it's not reloading or re asking, it's simply using the
cache that it stored on the device right now.
All right.
So now let's open a new tab and then we can be sure that the cache has been cleared.
There we go.
Whoops.
So let's see.
What's the difference here?
Example dot org.
And there we go.
We do see our dashboard appears over here and the dashboard tells us the TLS connection for these web
pages seems to be broken.
So the client failed to negotiate a TLS connection.
We've got app measure Google accounts and also example dot org.
But here it says receive Fatah alert.
So this is now the alert message we got over here and this means we are having an endpoint which the
device does not trust.
The device has some certificates preinstalled on it.
And these are the root certificates that makes our Internet secure.
Regarding to HTTPS.
Now the device is facing a website that has not this root certificate on it and therefore the device
is wrong.
This error over here, the disconnection is not private anymore.
So it might be a man in the middle attack.
What?
It might be a self signed certificate that we do not trust right now.
Don't worry too much about this.
We will go into this in detail in the next chapter that we talk about HTTPS, what a certificate means
and all this stuff.
If we've got this window over here as a user, if we now accept this, then we are in a bad position
if someone is attacking us right now.
So therefore let's perform it over here to get in this bad position that you get familiar what this
type of error message mean if you face this in the wild.
Let's see.
I guess we have to go into advanced.
Yes.
And here we can see.
Proceed to example but maybe.
Can we go back?
Yes.
But I would like to show you a certificate.
So within this arrow over here, this or this rectangle, exclamation mark, not a triangle.
Sorry, that's not a rectangle.
This triangle, exclamation mark.
If you click on this one, we can click on details and then we can say the certificate information.
And this is not a certificate that's provided to this client over here.
And this certificate says it's from your organization, Pacifica.
Pacifica has not an official root certificate, which is trusted by the client right now.
So therefore, Decline says, okay, I do not know anything about Pacifica, so I'm not sure about if
you really want to go further on this.
If we now simply accept those error messages or those warnings, these are warnings.
No error messages.
So let's see how we can get rid of this one.
Okay.
That's pretty rough.
There we go.
Also this one.
If you now click on advanced and proceed to example, then we can see the request will be made, this
request over here and if you click forward, we can also see the response.
So if we now change this text over here, you still have been hacked.
Even through HTTPS requests.
Then we can see the site, which is an HTTPS site and should be secured is now we are providing our
modified text and this is because we have trusted and untrusted certificate.
No, not this way.
We have trusted and let's call it unknown certificate.
Yeah, I guess that's that's the best way.
All right.
So that's all for now.
We have reestablished our man in the Middle Connection, and we took a little dip into our HBS connections.
And the next video we will figure out what's the difference between HTTP and HTTPS connections and how
we can apply modifications to the smartphone that we are also able to intercept.
HBS connections.
Alrighty.
Okay.
So I'm looking forward to see you in the next section.