In the previous lecture we seen how to downgrade TTP s Web sites to TTP.
This allowed us to basically see anything a user does on these websites because data and he's TTP is
sent in plain text.
Therefore we were able to see the user name use the passwords the URLs and anything they do on each
TTP as Web sites.
At the end of the lecture I also showed you that the method will not work against Facebook Twitter and
other Web sites that use heat as T.S..
The reason why it won't work against these websites because modern web browsers come with a list of
Web sites that they should only load over haste TTP s see what we were doing in the previous lecture
whenever browser requests a Web site.
We load that Web site even if it uses hash TTP as what we always give him back the hash TTP version
and HST yes the browser knows that this Web site for example Facebook dot com should always be loaded
over TTP s so even before sending this request to us it will always send it in TTP s and it will always
on the accepted if it comes back as his TTP s.
So there is nothing we can do really once we become the man in the middle because the browser is doing
this check locally it's checking this against a list that is stored on the computer itself.
Therefore the only practical solution at the moment to bypass Hage S T S is to make the browser think
that it is loading another Web site to do this.
We're going to replace all hate s t s links and loaded pages to similar links but they're not the same
links.
For example we can replace Facebook dot com with Facebook dot com on.
Now I know this seems very suspicious but trust me when it goes into the URL bar the R and here at the
middle it'll seem very similar to the M letter.
Another way of doing this you can replace Twitter dot com with Twitter dot com.
But with a single t here instead of a double team.
I know this sounds a little bit confusing right now but let me go and do it practically and you will
see how this is going to work.
So right here I have my Kelly machine and we're actually going to use the H S T S couplet that we used
in the previous lecture.
So I've already showed you where to download it and where to place it.
Please make sure you use the couplet that I gave you in the resources of this lecture not the one that
comes with better cup because the one that I gave you and the resources of this lecture is modified
and it contains code that will actually replace the domain names as shown in here.
The original one does not contain that code so it won't work as I'm going to show you right now.
So as shown in the previous lecture I already have my couplet in here and users share better cap couplets
and this is the name of the couplet.
If we go inside it we have a file called H S T S hijack dot cup.
This is the configuration file of the couplet so I'm gonna right click it.
I'm going to open it with other application.
I'm going to click on View all applications and you want to pick any text editor that you have.
So I'm going to keep this at least.
But you might have to scroll down to find it but I have it here.
I'm going to select and as you can see we have a normal text file will with all the configurations that
we can set.
And I've already reconfigured this for you.
The main thing is that you want to understand and maybe change is the targets and the replacements.
So the targets are the domains that use HST HECS that you want to replace.
For example I have to return dot com in here and they also have star dot with her dot com.
Basically when you use a star this is a wild card and it basically means any subdomain dot Twitter dot
com is a target as well.
And the replacement you want to tell the program what to replace this target with for example whenever
we see Twitter dot com we're gonna replace it with Twitter dot corn.
Similar goes for Facebook and Apple and a few other domains that I said You can also play around with
the obfuscate and encode options.
I've said both of these two false because basically what these will do they'll obfuscate the code and
encoded.
But I noticed some browsers like Firefox will block obfuscated or encoded code.
That's why I said both of these two faults so that the code is left as is here in the payload.
You can set any other javascript code that you want to inject.
Live this the same.
We'll talk about JavaScript injection and a future lecture.
Finally you want to make sure that the DNS proof domains are said exactly the same as the replacements
in here.
So I literally copy this line and paste it here.
Now I'm actually going to keep all of this the same.
I don't need to modify any of it but like I said if you're targeting different websites or if you want
to use different replacements for example if you wanted to use a Twitter with a single T and keep this
dot com you can do that here if you wanted to use a Facebook with a single Oh and keep this dot com
again instead of those current.
You can do it here once done make sure you're safe and quit.
This file and we're ready to run the attack.
So running this attack is actually going to be identical to what we did in the previous lecture.
You just want to make sure you modify this file properly so going back to Buttercup better cup.
I'm going to clear the screen run better cup with the same command loading the spoof couplet so we can
do all of the AARP spoofing commands and run the sniffer all automatically and perfect as you can see
everything is running as expected with no errors.
If you run this and you get an error just do exit and run better cap again.
Next we want to run the couplet the USGS hijack couplet exactly as shown in the previous lecture.
All we have to do is type each as tab it'll auto complete for us and hit enter to run it again.
As you can see no errors.
So everything is working as expected.
Let's go to the target's machine and see how this is going to work.
So I have my windows machine right here.
This is Chrome.
The latest version and April 2019 and before I do anything like I said it's a good idea to always just
remove the browsing data and before I actually load any Web sites it is very important to understand
that even with everything that we're doing right now if you try to go to Facebook and type dot com at
the end here it will not work.
What we're doing right now will not work because chrome right here has a list that is stored on this
computer that says do not load Facebook dot com unless it is loaded over haste TTP S..
So if you tell Facebook right here like this it will not work.
The only way we can do this is if the user first goes to search engine for example Google that I e for
Ireland and then in Google as you can see Google doesn't use HST.
Yes.
So we bypass this using the normal hash CPS bypass and then if the user in here searches for their target
Web site for example Facebook
then our script is going to run in the background and it's going to replace all links in this page for
Facebook dot com with Facebook dot corn.
So if I actually hover over this you'll see in the status bar the website that will be loaded is Facebook
dot corn not Facebook dot com.
This is fine here.
It still says Facebook dot com but only in the code of the hasty M.L. page Facebook dot com got replaced
with Facebook dot com.
So if I click on this link again as you can see we get a normal Facebook page but if you look here on
top you'll see there is no hash TTP s and if you look at the domain name you'll see it says Dot corn
not dot com.
Again like I said you can actually keep this dot com and use Facebook with one 0.
Or you can add an extra Oh you can be as creative as you want with this.
This is just an example that I'm giving you now.
Once we're here we can log in normally with my user name so Z adds that security dot org and put my
password 1 2 3 4 5 6 7 8 9 0 hit enter and if we go back scroll up perfect as you can see we have the
user name Z at Z security dot org and the password all the way up to 9 0 now like I said the only way
for this to work is if the user gets to Facebook through another Web site that does not use H S T as
if they go on the URL bar and type Facebook dot com themselves.
We will not be able to do this.
That's why this is considered as a partial solution and not a full solution.