OK so now that we understand the theory behind bypass and hash TTP us and we have the correct couplet
placed in the correct path.
Let's go ahead and use this couplet with better buttercup and see how we can downgrade TTP s to TTP
and steal passwords from log and pages that use haste TTP s by default.
So I'm gonna go to my terminal and I'm going to use better cup exactly as I've been using it before.
So we're doing better cups the name of the program will give unit our interface after the face argument
we're using the couplet argument to specify a couplet to run as soon as we run the program and we're
running this spoof couplet the one that we built in the previous lecture that run the AARP spoofing
command and run the sniffer for us so I'm going to hit enter and as you can see everything got executed
as expected.
If we do help we'll see all the running modules and we have the AARP spoof and the sniffer running with
the recon and with the probe.
So this is exactly what we wanted from our couplet.
The next thing that we want to do is run the hake s t s bypass couplet the one that we just downloaded
and placed in our Buttercup directory.
So first of all the hey just yes bypass couplet is one of many couplets that Buttercup comes with if
you want to list all of these couplets you can do couplets that show and as you can see you'll get a
list of all of the couplets that you have and their location on the system.
Now the couplet that we want to run is the H S T S hijack couplet.
This one right here and you can see it stored in here.
This is the location where we actually replaced it with the one that we downloaded and to run any of
these couplets all you have to do is literally just type its name and as usual you can use the top two
auto complete so to run our couplet right here.
All I have to do is literally type Hage s and press tab and as you can see it will automatically auto
complete for me and type the Catholic name.
Now if I had enter this allowed the couplet with all of its options and it will run it for me.
So as you can see because we don't see any errors this means everything got executed as expected.
So let's go to the Windows machine browse some hash TTP pages and see if we can sniff data user names
passwords and your ls that they enter on their computer so I have my windows machine here I have chrome
installed.
This is the latest version of Chrome.
At the time of recording this lecture which is in April 2019 now a really good idea before trying all
of these things is to remove your browsing data because the websites that we're going to try to access
might be cached and they might be just loaded from your cash.
This will only happen if you're visiting the same Web site over and over again mostly when testing.
Therefore it's a really good idea to control shift delete and click on clear browsing data.
Make sure all of this is clicked.
Make sure it's set to all the time and click on clear to remove all of it and let let's go ahead and
go to a Web site that uses hash TTP s.
So a good example would be linked in dot com
and perfect.
If you look here at the top you'll see the Web site is loading over hash TTP not over hasty G.P.S..
Therefore we'll be able to see anything the user enters in these boxes.
So let's put a username let's set it to Zaid at Z Security dot org and I'll put a password as 1 2 3
4 5 6 7 8 9 0.
Doesn't really matter you can use any password and I'm going to hit enter to log in.
This is wrong so obviously we're getting an error message but if we go back to Carly as you can see
we're capturing all of this data because it's not being sent over a hasty US anymore it's being sent
over hash TTP and if you look in here you can see we captured log in information it's sent to LinkedIn
dot com sent to this specific UA l a log in your URL and you can see the user name is Zaid at Z Security
dot org and the password is 1 2 3 all the way up to 9 0.
So that's really really good.
Let's go ahead and test another hasty CPS Web site.
Let's go to stack overflow.
Dot com.
Again you can see on top it's loading overhead TTP notation TTP s so I'm going to click on log n and
again I'm going to put my emails a that Z Security dot org and we'll put a password as one two three
four five six seven eight nine zero hit enter.
Let's go to the Kelly machine again.
Scroll down this time because we're stuck on top.
Perfect.
You can see we have a post request in here.
It's sent to this specific U.R.L. again.
You can see log in in the URL.
You can see the Web site itself.
Stack Overflow dot com.
And if we scroll down a little bit more we can see that the user name is Zaid at that security dot org.
And the password again One two three all the way up to 9 0 so that is really really good.
Now we can downgrade any hasty G.P.S. connection to TTP as long as the target's Web site uses hash TTP
as not hedge as T.S..
So this method will work against pretty much all Web sites that use hash TTP as except for the really
popular Web sites such as Facebook Twitter and so on.
So let me show you a quick example.
If I go here and try to go to Facebook dotcom you'll see that the Web site got loaded over Haitian TTP
s not overheated TTP even though we configured our couplet correctly.
And even though we're able to downgrade haste TTP has connections on a lot of Web sites such as LinkedIn
and Stack Overflow.
This is happening because Facebook is using Hage as t us which is a little bit trickier to bypass in
the next lecture.
We'll talk more about what HST says is why it's tricky to bypass and how to partially bypass it and
still get usernames and passwords from the Web sites that implemented such as Facebook Twitter and so
on.