In the last lecture we've seen theoretically how a black hat hacker can attake the HTTPS protocol.
In this video I'll show you a live example of SSL Sniffing. The attack can be executed from any Linux machine
using tools like ettercap or bettercap.
I'm going to use Linux Mint ettercap because in the latest version of Kali these tools are a little
bit buggy when executing the attack.
If you want to run it on Kali you execute all all commands and follow all steps exactly like this.
There is no difference
in fact. Let's get started ! By default
ettercap is not performing the ssl sniffing attack.
This means intercepting the server certificate, generating a new fake one on the fly and sending it to
the victim.
Let's change the ettercap config file to activate ssl sniffing!
I'm opening the configuration file of ettercap It's in /etc/ettercap and then enter.conf.
This is the configuration file of ettercap; and almost at the end of the file I'll uncomment 2
lines related to iptables. These 2 lines!
If you see here another 2 IP tables rules related toipv6, please uncomment
those 2 lines as well
in order for the attack to work! And I am saving the file and then quit.
Let's start the ARP spoofing attack.
The victims will be the Windows machine,
this one, and the default gateway.
So ettercap -T -M ARP the first victim the default gateway // and
the Windows machine,
the second victim.
We had an entire lecture on ettercap and you can recap from there if you feel the need. I'm launching
the attack! Let's check that the the attack was successful on the victim: arp -a
and we notice that both the default gateway and the hacker have the same MAC address in the arp
table.
This is the hacker and this is his MAC address.
Let's check it just to be sure! Ok the IP address ends 151 and the MAC address ends
in 91
Now
let's visit a website using https!
This is the victim machine, let's say bbc.co.uk
wow we notice this the certificate error: your connection is not private.
This certificate is not the authentic certificate sent by the server but it's the fake certificate generated
by the hacker. The connection to the site is not secure! If the user accepts the certificate and clicks
on proceed to bbc.co.uk
the hacker will capture all data in clear text and the user will be hacked!
In the ettercap window
we already notice unencrypted traffic.
Remember that in the last lecture I have said that this attack cannot be performed on HSTS domains
If we check this domain bbc.co.uk on hstspreload.org
will see that it's not in the list. Let's try another domain,
this time a domain that's in the list,
for example Facebook,com! Okay!
We see the same security warning "your connection is not private" but there is no way to continue.
It says that you cannot visit Facebook.com right now because the website uses HSTS.
So HSTS does not allow us to visit some particular websites in an unsecure manner.
It protects the user against this attack and many others; and I'm stopping the attack by pressing on q
in ettercap window.It's RE-ARPing the victim. That's all.
Thank you!