In the last lecture I've shown you how to launch a SSL Sniffing attack on HTTPS
protocol. We'll move on and see the second attack on HTTP called SSL Stripping.
I've already explained to you in detail what it does
so let's go straight into line to the attack.
I’m gonna use bettercap on Kali! First
I'm becoming root; because there are many parameters that need to be set and modules that need to be
started
I'll create a caplet and then start bettercap giving that caplet. I'm moving to /root
directory and here using Vim I'm creating the caplet let's say ssl_stripping.cap
First
I'm starting net.probe module which is required.
net.probe on Then I'll set the options for ARP spoofing.
This attack is of type MITM and arp.spoofing is also required.
So set arp.spoof
.fullduplex true
now the target
the IP address of the Wndows machine and I'm starting the module arp.spoof on The next step is
to set parameters and start net.sniff module.
set net.sniff.local true This option is required and set net.sniff.
verbose false and I am starting the module: net.sniff on
And finally I'll start the http.proxy module! Let's set some options for this module and then start
it! set http.proxy
.script and the path to a javascript file.
This file is already in the bettercap directory.
And the option for SSL stripping!
set http.proxy.sslstrip true
and I'm starting the module http.proxy on! Okay, one mistake here!
There is also a directory in the path called a HSTS hijack
I'm saving the file and then start
bettercap: bettercap -iface the name of the interface eth0 -caplet and the name of the caplet
ssl_stripping.cap
OK, it has started!
The attack is running! Let's
check theARP table of the victim:
arp-a
This is the default gateway and that this is the hacker.
Both have the same MAC address!
Let's go to the victim machine and visit a website that normally uses an encrypted connection like
ing.com
and we notice that the connection is not secure bettercap has downgraded the connection to HTTP, it's
not a secure connection.
Normally this connection would use HTTPS; before visiting the site I'd recommend you to clear all
browser data by pressing on control
+shift + Del
This attack involves cookies sessions and so on and they should not already be on the client's machine,
so it would be great for the victim to visit the website for the first time.
I won't clear browsing data now.
Let's try another domain: shops.audi.com
and it's an HTTP connection; without this SSL Stripping running it would have used an encrypted one
HTTPS was downgraded to HTTP.
And finally let's try to visit on HSTS domain like YouTube.com
and it's not working.
The connection is encrypted; we see this lock here and that the connection is secure.
SSL Stripping is not working on HSTS domains, they are immune to this attack.
OK, that's all about SSL Stripping! In the next lecture
I'll give you some advice on how to keep yourself safe while visiting the Web.