Instructor: In the previous lecture,
we seen how to downgrade HTTPS websites to HTTP.
And this allowed us to basically see anything a user does
on these websites because data in HTTP
is sent in plain text.
Therefore, we were able to see the usernames, the passwords,
the URLs, and anything they do on HTTPS websites.
At the end of the lecture, I also showed you that the method
will not work against Facebook, Twitter and other websites
that use HSTS.
The reason why it won't work against these websites,
because modern web browsers come with a list of websites
that they should only load over HTTPS.
See what we were doing in the previous lecture.
Whenever a browser requests a website, we load that website,
even if it uses HTTPS,
what we always give him back the HTTP version.
In HSTS, the browser knows that this website, for example,
facebook.com, should always be loaded over HTTPS.
So even before sending this request to us,
it will always send it in HTTPS.
And it will always only accepted if it comes back as HTTPS.
So there is nothing we can do really,
once we become the man in the middle.
Because the browser is doing this check locally,
it's checking this against a list that is stored
on the computer itself.
Therefore, the only practical solution at the moment
to bypass HSTS is to make the browser think
that it is loading another website.
To do this, we're gonna replace all HSTS links
in loaded pages to similar links,
but they're not the same links.
For example, we can replace facebook.com with Facebook.corn.
Now, I know this seems very suspicious,
but trust me when it goes into the URL bar,
the RN here at the middle, it will seem very similar
to the M letter.
Another way of doing this, you can replace twitter.com
with twitter.com, but with a single T here instead
of a double T.
I know this sounds a little bit confusing right now,
but let me go and do it practically,
and you will see how this is gonna work.
So right here I have my Kali machine.
And we're actually gonna use the HSTS caplet
that we use in the previous lecture.
As mentioned in the previous lecture,
this caplet is already installed in the custom Kali,
if you want to use it with the original Kali,
you'll have to manually download it
and place it in the right path,
in user, local, share, bettercap, caplets.
I have the caplet right here.
Like I said, this is already the correct one
because I am using the custom Kali,
if we go inside it, we have a file called hstshijack.cap.
This is the configuration file of the couplet.
So I'm gonna right click it,
I'm gonna open it with other application,
I'm gonna click on view all applications.
And you want to pick any text editor that you have.
So I'm gonna keep this at leafpad.
You might have to scroll down to find it,
but I have it here, I'm gonna select.
And as you can see, we have a normal text file
with all the configurations that we can set.
And I've already pre configured this for you.
The main things that you want to understand and maybe change
is the targets and the replacements.
So the targets are the domains that use HSTS
that you want to replace.
For example, I have twitter.com in here,
and I also have star.twitter.com.
Basically, when you use a star, this is a wild card.
And it basically means any subdomain.twitter.com
is a target as well.
And the replacement, you want to tell the program,
what to replace this target with.
For example, whenever we see twitter.com,
we're gonna replace it with Twitter.corn.
Similar goes for Facebook and Apple,
and a few other domains that I said.
You can also play around with the obfuscate
and encode options.
I've set both of these to false,
because basically what these will do,
they will obfuscate the code and encoded.
But I noticed some browsers like Firefox will block
obfuscated or encoded code.
That's why I set both of these to false
so that the code is left as is.
Here in the payload, you can set any other JavaScript code
that you want to inject, leave this the same,
we'll talk about JavaScript injection in a future lecture.
Finally, you want to make sure that the DNS spoof domains
are set exactly the same as the replacements in here.
So I literally copy this line and paste it here.
Now I'm actually gonna keep all of this the same,
I don't need to modify any of it.
But like I said, if you're targeting different websites,
or if you want to use different replacements, for example,
if you wanted to use a Twitter with a single T
and keep this .com, you can do that here.
If you wanted to use a Facebook with a single O,
and keep this .com, again, instead of .corn,
you can do it here.
Once done, make sure you save and quit this file.
And we're ready to run the attack.
So running this attack is actually gonna be identical
to what we did in the previous lecture,
you just want to make sure you modify this file properly.
So going back to bettercap, I'm gonna clear the screen,
run bettercap with the same command,
loading this proof caplet.
So we can do all of the AARP spoofing commands,
and run the sniffer all automatically.
And perfect, as you can see everything is running
as expected with no errors.
If you run this and you get an error,
just do exit and run bettercap again.
Next, we want to run the couplet, the HSTS hijack caplet,
exactly as shown in the previous lecture,
all we have to do is type HS tab,
it will autocomplete for us and hit enter to run it.
Again, as you can see no errors
so everything is working as expected.
Let's go to the target machine
and see how this is gonna work.
So I have my Windows machine right here.
This is Chrome, the latest version.
And before I do anything, like I said,
it's a good idea to always just remove the browsing data.
And before I actually load any websites,
it is very important to understand that even with everything
that we're doing right now, if you try to go to Facebook,
and type .com at the end here, it will not work,
what we're doing right now will not work.
Because Chrome right here has a list that is stored
on this computer that says do not load facebook.com
unless it is loaded over HTTPS.
So if you tell Facebook right here like this,
it will not work.
The only way we can do this is if the user first
goes to search engine, for example, google.ie for Ireland.
And then in Google, as you can see, Google doesn't use HSTS.
So we bypass this using the normal HTTPS bypass.
And then if the user in here searches for their target
website, for example, Facebook,
then our script is gonna run in the background.
And it's gonna replace all links in this page
for facebook.com with facebook.corn.
So if I actually hover over this,
you'll see in the status bar,
the website that will be loaded is facebook.corn,
not facebook.com.
This is fine here, it still says facebook.com.
But only in the code of the HTML page
facebook.com got replaced with facebook.corn.
So if I click on this link, again, as you can see,
we get a normal Facebook page.
But if you look here on top, you'll see there is no HTTPS.
And if you look at the domain name,
you'll see it says .corn not .com.
Again, like I said, you can actually keep this .com
and use Facebook with one O or you can add an extra O,
you can be as creative as you want with this.
This is just an example that I'm giving you.
Now once we're here we can login normally with my username
so z@zsecurity.org and put my password 1234567890.
Hit enter, and if we go back, scroll up.
Perfect, as you can see, we have the usernames,
z@zsecurity.org and the password all the way
up to nine zero.
Now, like I said the only way for this to work
is if the user gets to Facebook through another website
that does not use HSTS.
If they go on the URL bar and type facebook.com themselves,
we will not be able to to do this,
that's why this is considered as a partial solution
and not a full solution.