Instructor: Now, everything that we did so far
will only work against HTTP pages.
The reason why it works against HTTP
because as we've seen,
the data in HTTP is sent as plain text.
So it's text that humans like us can read and understand.
That's why when we're the man in the middle,
we're able to read this text
and if we wanted, we're able to modify this text
as we wish.
Now, this is obviously a problem
and this problem was fixed in HTTPS.
So as you know, most websites use HTTPS.
The reason why, like I said,
because it's a more secure version of HTTP
and basically, the way it works
is it adds an extra layer over HTTP,
which is where the S comes from.
So it's a secure HTTP protocol
and this extra layer will encrypt the plain text data
that HTTP sends.
So if a person manages to become the man in the middle,
they will be able to read this data
but the data will be gibberish.
It will not be readable
to the person intercepting the connection.
Now, HTTPS relies on TLS or SSL to encrypt the data
and this is very difficult to break.
Therefore, in order to bypass this,
the easiest method
is to downgrade HTTPS connections to HTTP.
So since we're the man in the middle,
we can check if the target is requesting an HTTPS website
and instead of giving him the HTTPS version of that website,
we will give him the HTTP version.
This way, the data will be sent in plain text
and we'll be able to read it exactly as I showed you
in the previous lecture.
To do this, we'll have to manually configure
and use a tool called SSL Strip
and I show how to do this in my more advanced courses
but luckily, bettercap has a caplet
that does all of that for us.
I also modified this caplet myself
to get it to work more reliably and on more websites.
So please make sure you use the custom Kali image
that I made for this course
because it comes with this modified caplet by default.
If you want to use the original Kali,
then you're gonna have to manually download this caplet
and put it in the right path.
I am using the custom Kali in here,
so I won't need to do any of that.
I can simply run bettercap and use it
but before doing that,
I just want to go to the home directory
and modify the spoof caplet that we have been using
in the previous lectures.
And I just wanna modify one thing in this.
So I'm gonna right click it
and open it with Leafpad.
And what I wanna modify is I want to add an option
to the sniff in here.
So as you know, this line net.sniff on
will turn on my sniffer
but before turning it on,
I want to set the net.sniff.local to true.
And what this option will do,
it will tell bettercap to sniff all data,
even if it thinks this data is local data.
The reason why I set this option to true
because once we use the HTTPS bypass caplet,
the data will seem as if it's being sent
from our computer.
So bettercap will think these passwords belong
to me, to my computer
and it will not display it to me on screen.
That's why we're setting it to true
so that we can see all the usernames
and the passwords sent on the websites
that we will downgrade from HTTPS to HTTP.
So I'm gonna save this, Control + S
and quit it, Control + Q
and now we are actually ready
to go and use this caplet
and see how we can downgrade HTTPS to HTTP
and steal passwords from login pages
that use HTTPS by default.
So I'm gonna go to my terminal
and I'm gonna use bettercap exactly
as I've been using it before.
So we're doing bettercap, the name of the program.
We're giving it our interface
after the iface argument.
We're using the caplet argument
to specify a caplet to run
as soon as we run the program
and we're running the spoof caplet,
the one that we built in the previous lecture
that will run the ARP spoofing command
and run the sniffer for us.
So I'm gonna hit Enter.
And as you can see, everything got executed as expected.
If we do help,
we'll see all the running modules
and we have the arp.spoof and the sniffer running
with the recon and with the probe.
So this is exactly what we wanted from our caplet.
So first of all, the HSTS bypass caplet
is one of many caplets that bettercap comes with.
If you want to list all of these caplets,
you can do caplets.show
and as you can see,
you'll get a list of all of the caplets
that you have and their location on the system.
Now, the caplet that want to run is the hstshijack caplet.
This one right here.
And to run any of these caplets,
all you have to do is literally just type its name.
And as usual, you can use the Tab to auto complete.
So to run our caplet right here,
all I have to do is literally type hs
and press Tab and as you can see,
it'll automatically auto complete for me
and type the caplet name.
Now, if I hit Enter, this will load the caplet
with all of its options
and it'll run it for me.
So as you can see, because we don't see any errors,
this means everything got executed as expected.
So let's go to the Windows machine,
browse some HTTPS pages
and see if we can sniff data, usernames,
passwords and URLs that they enter on their computer.
So I have my Windows machine here.
I have Chrome installed.
This the latest version of Chrome at the time
of recording this lecture.
A really good idea before trying all of these things
is to remove your browsing data
because the websites that we're gonna try to access
might be cached and they might be just loaded
from your cache.
This will only happen if you're visiting the same website
over and over again, mostly when testing.
Therefore, it's a really good idea
to Control + Shift + Delete
and click on clear browsing data.
Make sure all of this is clicked.
Make sure it's set to all the time
and click on Clear to remove all of it.
And let's go ahead and go to a website
that uses HTTPS.
So a good example would be LinkedIn.com.
And perfect.
If you look here at the top,
you'll see the website is loading over HTTP,
not over HTTPS.
Therefore, we'll be able to see anything the user enters
in these boxes.
So let's put a username.
Let's set it to zaid@zsecurity.org.
And I'll put a password as 1234567890.
It doesn't really matter.
You can use any password.
And I'm gonna hit Enter to log in.
This is wrong, so obviously we're getting an error message
but if we go back to Kali,
as you can see, we're capturing all of this data
because it's not being sent over HTTPS anymore.
It's being sent over HTTP.
And if you look in here,
you can see we captured login information.
It's sent to LinkedIn.com.
Sent to this specific URL, a login URL
and you can see the username is zaid@zsecurity.org.
And the password is 123 all the way up to 90.
So that's really, really good.
Let's go ahead and test another HTTPS website.
Let's go to StackOverflow.com.
Again, you can see on top,
it's loading over HTTP, not HTTPS.
So I'm gonna click on Log In.
And again, I'm gonna put my email.
Zaid@zsecurity.org.
And we'll put a password as 1234567890.
Hit Enter.
And let's go to the Kali machine again.
Scroll down this time 'cause we're stuck on top.
And perfect, you can see we have a POST request in here.
It's sent to this specific URL.
Again, you can see login in the URL.
You can see the website itself.
Stackoverflow.com.
And if we scroll down a little bit more,
we can see that the username is zaid@zsecurity.org
and the password again, 123, all the way up to 90.
So that is really, really good.
Now we can downgrade any HTTPS connection
to HTTP as long as the target website
uses HTTPS, not HSTS.
So this method will work against pretty much all websites
that use HTTPS, except for the really popular websites,
such as Facebook, Twitter and so on.
So lemme show you a quick example.
If I go here and try to go to Facebook.com,
you'll see that the website got loaded over HTTPS,
not over HTTP,
even though we configured our caplet correctly
and even though we're able to downgrade HTTPS connections
on a lot of websites,
such as LinkedIn, and Stack Overflow.
This is happening because Facebook is using HSTS,
which is a little bit trickier to bypass.
In the next lecture,
we'll talk more about what HSTS is,
why it's tricky to bypass
and how to partially bypass it
and still get usernames and passwords
from the websites that implement it,
such as Facebook, Twitter and so on.