Welcome back, guys.
In the last video we have extensively talked about has how to establish a secure channel.
And we also talked a little bit about it, how we could break off this connection.
Trust in theory.
Now, in this video, we want to repeat this over here, the theory part, and then we will also do
the practical part regarding to this one.
We will install our own certificate on the smartphone, and then we will intercept HTTPS connections.
So let's have a look into this.
Here we have now our well-known setup.
We've got our smartphone, but this time the smartphone is making a connection to https google dot com.
Then the service presenting the certificate, the smartphone trust certificate, there's some key exchange
by element.
And then we have our secure channel over here.
Absolutely perfect.
That's how HTTPS works.
But now as an attacker, we want to break it off and we need to break it off at this point over here
at our USB to Ethernet adapter.
Therefore we need to remove this yet this secure connection at this point over here.
All right.
If you break off this connection, the smartphone is still trying to connect to a web server regarding
to HTTPS.
Therefore, we need to present the certificate at this point.
So we need to create our own certificate.
The problem right now is if we are presenting the certificate, the smartphone will looks it up.
I mean, that's not a problem.
That's what it is right now.
And that's good because otherwise https won't work.
But for us as an attacker, we want to get into the traffic of this application and therefore we have
to deal with this.
So the smartphone is now looking up.
If this certificate has been signed by invalid authority or if it even has been created by invalid authority.
In this case, it checks the internal certificate storage and realizes, nope, it's not in there.
So the smartphone simply tells us about this phone over here.
All right.
The connection gets aborted and we cannot see any traffic anymore.
Now, if you want to analyze this app, we need to install our certificate on our own smartphone over
here.
By having our certificate installed on the smartphone, the smartphone looks it up and realizes, okay,
this is an trusted authority.
Therefore, no matter what domain is in here, I will trust this so we can create certificates, for
example, dot com google.com and whatever we like.
That's the advantage of having our own certificate as entrusted authority on our smartphone.
And now the smartphone trust our certificate over here.
So the smartphone is not complaining about some issues anymore.
And that's absolutely great, right?
Besides this, the smartphone is also establishing now an secure channel with us.
So we have the same approach.
The smartphone is asking for a certificate.
We are now presenting our certificate.
The smartphone accepts it right now, and we have now our secure connection over here.
So the magic happens once again, but this time we have all the necessary information, the private
key to decrypt all this stuff.
And now we can also analyze this traffic, which is super amazing, right?
Absolutely.
And we do not have to worry too much about this.
This is all done within the speed.
Afterwards, the traffic gets simply redirected to the real application.
So in this case Google.com and we are now having a proxy in between them and we can also analyze the
whole traffic because we have everything we need right now.
Nice.
So therefore I would suggest let's do some hands on exercise.
Let's set it up on our smartphone over here.
This one, let's install the certificate and then have a look how all this.
Yeah, this takes effect.
All righty.
So let's go.
Alrighty.
So here we are back on our Ubuntu VM.
First, let's have a look if our interface is available from our USB to Ethernet adapter and we can
see not it's not there because I haven't plugged it in yet.
So how fast can we re okay.
I just plug it in
and there we go.
It's plugged in and we wait, I guess.
4 seconds.
There we go.
Oh, it hasn't signed an IP address yet.
Now, there we go.
Just wait a little bit longer then.
Yeah, it should work out of the box right now.
That's the amazing thing about the setup.
All right.
Now, we also got our smartphone connected.
This one over here.
Let's get back to the screen.
Oops.
Little typos, green copy.
There we go.
OC smartphone also connected, but we can see it hasn't connected yet to the wi fi.
So therefore we go into settings.
The wi fi.
And we wait until the smartphone connects to this phone over here.
OC IP address obtained.
Now we've got an hour connection over here.
The next part we need to do is we need to run our burp suite.
Sweet.
Oh, it's between tools.
And then I use the patch script.
Which was temporary project.
The pitchforks.
And now we can click this away because we are not having the pro version within proxy.
Options.
We select now our 1042 zero interface.
This one over here.
And now we also need to select an invisible proxy.
So this checkbox needs to be enabled.
Otherwise we are not forwarding this traffic to the to the red connection.
So we also check this one over here.
All right, now we open a new terminal, and the last thing we need to do is we need to forward our
packages to this interface here.
We can do this with the IP tables, command IP tables, the team that we want to select the next table.
Now we want to append a new rule pre route.
Oops, that's a problem.
Pre routing protocols should be all packages regarding to TCP destination port 80.
We later select 443 also and now we want to change the destination address to destination 1042 0.188.
If this was a little bit fast to you because you would jump directly into this video, I have prepared
an extensive video where we talk about this command over here and this one is being enabled.
Now, let's also add HTTPS traffic, four, four, three.
And now let's verify real quick if everything has been set up.
So this command lists out these entries and we can see.
Yes.
And so as destination destination port eight to this destination also for destination portfolio three
to this destination.
We've got our update notifier and we click it away.
All the smartphone lost the connection.
I guess this was the problem we had earlier.
So let's see, that's our burp suite.
And yeah, so somehow the smartphone got lost.
The connection.
Let's open it once again.
There we go.
Okay.
And let's put this in foreground and now let's verify if the setup works.
So.
Yeah.
Let's do it this way.
HDPE is three.
Let's try to open a web page and we are choosing new incognito type https example dot org.
Yes, we get this connection warning and with any burp suite we can see over here, this one received
fatal alert.
Certificate is unknown.
Now let's install the certificate that the perp is using over here on the smartphone.
And that's not really hot because everything is really set up nicely regarding to the.
Let's see if we can do it this way.
So if you are opening http 1042 0.1 88, that's the instance where our burp suite is listening and we
can now see this button, see a certificate.
We can now click this button and then the certificate will be downloaded.
The only problem regarding to this one is the certificate is with the extension and the smartphone doesn't
accept this.
So let's try to install it and then we will see what's going on.
Two inside the certificate, we can now go into settings.
And then let's see.
Security.
Encryption and credentials.
And here, install a certificate.
This might be different.
It depends on the manufacturer you have.
Maybe the easiest way is searching via this one here for install a certificate or simply certificate.
If you have any problems regarding to this one, then please just write me a message with your model
and we will figure out how we can install the certificate for your device.
Okay.
Instead of certificate.
And now we select see a certificate.
Then we get this warning because installing a custom certificate, I mean, this can break off the complete
HTTPS traffic and yeah, we need to think about this, so please not do this on a productive device,
only do this on test devices.
Otherwise you might get men in the middle.
We say install anyway because that's a testing device.
Okay, so here we are now in the in the SD card of the smartphone and within downloads we have now our
birth certificate, but we cannot select it.
And the reason for this is we need to rename this extension.
I don't know why that's the case, but yeah, let's simply do this.
So we open a new terminal once again.
There we go.
And now we simply connect via ATP to our device and be renamed this file over here.
So ADB Shell.
Then we go into the Sdcard directory and then within download we have our C search dot DDR and now we
move this file from c r search DDR to c assert or maybe let's call it simply brb dot CRT.
And now we can see the transition on the right.
Now we have the certificate file being selectable.
Let's select it over here and you see a certificate has been installed.
Not that was all right.
Now that's all we need to do.
We can now simply close this one over here and then.
Yeah, let's simply reopening this top.
So let's open a new Incognito tab.
Parts observe it in deeper within the interceptor.
We can now also see those.
Yeah.
Those requests.
So let's turn the interceptor off.
Otherwise, the request will be passed over here.
Select the history once again.
And now let's opening https example dot org and we can see no warning anymore and we can see over here
we've got this https traffic.
So now we are able to men in the middle https traffic without having the choice to select this stuff.
Now you might ask, but if you simply select this warning, then is it the same?
It looks like it is at the first view, but it isn't.
So by selecting this warning over here, we are accepting this host that this host has a certificate
that we trust right now, even if it's not listed in our smartphone.
But if the application is making requests to different hosts, these requests will be missing.
Right now might be the case that your smartphone is making different requests in the background and
these windows doesn't appear anymore.
So these requests cannot be certainly accepted, which means these requests will terminate at the end.
So if you select yes, then the pages loading, but only partially because the web application might
perform some other requests in the background which are also related to HTTPS.
But these do not appear with some pop up that says, okay, we've got another insecure connection.
Do you want to accept that these simply terminate at zero?
So this means there will be no request regarding to these endpoints, which means we lose a lot of information
and this is definitely something we do not want to have.
So installing a certificate and accepting a warning that's not the same as setting the warning will
only partially give us access to the whole network stream.
Not all in there.
Therefore let's go for the certificate approach because then we have all and yeah, as already mentioned,
we want to have all, every single port, every single connection, every single request.
Okay.
So that's about installing the birth certificate this way.
But let's assume you want to install a different certificate which has not that handy button over here.
Then we have to do it in the following way within deeper options.
For example, we can also say import and export the CA certificate.
And then we can select a certificate in the AR format next.
And now this certificate will be stored as a local file.
And let's call this verb to CRT.
Okay.
Now, the certificate has been saved and this might be the case.
If you are also generating your own certificates, then you do not have this nice pop up window here.
You just have the certificate file like this one over here.
Let's put it on the site.
Yeah.
This one.
So now let's put this one on the smartphone.
So we open a new terminal here, and then we simply say ADB, push CRT onto the SD card.
Maybe, maybe let's rename it differently.
But to CRT.
Well.
Sorry, this one is called Burp CRT, but here we name it now burp two zero.
There we go.
All right, now in the SD card.
So let's switch to the to the smartphone and go onto the SD card.
We have now these two files.
Let's remove the first one.
Oops.
There we go.
So let's assume now you have your own certificate.
We have now pushed it in this one here onto the SD card, and now we want to install this one approach
exactly the same.
You go into settings.
Security.
Encryption and credentials.
Instead a certificate C a certificate instead anyway.
And then instead of the downloads directory, we now go into the SD card.
So one directory back.
And if you scroll down a little bit, there we go.
We have our burp burp 2.0 t over here.
We can now select this part, yet the certificate has been already installed.
By the way, if you want to have a look at which certificates has been installed on our device, we
can also see this over here.
So trust the credentials and let's put this maybe in the middle and you can see it better.
And so here we have now to certificate storage.
We've got the system and we've got the user.
The system is the cert storage that it's preinstalled on the device.
So if you perform a factory reset, these are the certificates that gets restored.
And we can now see these are all trusted authorities.
And if you scroll down a little bit, you can see, well, these are a lot trust that authorities.
Beside the system storage.
There is now also the use of storage.
This one over here and here we can now see our installed certificates.
Pots we can see.
So let's see.
That's the certificate from the burp suite, which has been automatically being generated.
And if you scroll down, we can see all the stuff.
So our web suite is also now a valid authority for this device over here.
Therefore, this device trust every HTTPS connection that has this certificate installed.
Nice, isn't it?
All right, so that's all for this video right now.
We have learned how we can install our own certificate over here to break often as a connection.
In the next video, we take a look at certificate pinning.
This is some security mechanism that only accepts a certain certificate.
These certificate or these certificates are not being trusted anymore.
The system and the user certificates only the certificate of the developer.
And this means even by having our certificate installed on this device, we cannot see this traffic.
This is some common security mechanisms you will find in.
Yeah, not call it all, but really many applications out there right now.
So therefore you absolutely need the skill to bypass this security protection to analyze traffic afterwards.
And you know what?
This is exactly what you learn here.
And you do not learn one way.
You learn many ways to do this.
So therefore, I see you in the next video.