In the previous lectures, we covered how to sniff and read data from hasty HTTP, https and preloaded
sites websites.
We spoke about the limitations of each of these cases, but we did that as we are going through the
lectures.
Therefore, I feel like some of the details might be missing.
And therefore, I made this table right here, and I'm going to show you some examples and this lecture
just to lay everything down for you so you understand exactly how this is going to work and what are
the limitations.
So first of all, we spoke about HTP websites and an example of this would be a website that doesn't
use HTTPS, just loads of plain htp similar to Vanilla ABC.com.
Then we spoke about stps websites and this would cover most websites on the internet.
So examples would be linked to intercom one zip stock overflow Google the local google.
So not google.com but the Google Dot IEEE or echo dot UK or dot i and any local Google domain and Netflix
dot com.
Now the list here could go on for very long because like I said, most websites use HTTPS.
And finally, we spoke about the most restrictive and the most secure method of communication, which
is pre-loaded sites, websites.
And the way this works, we said the web browser itself will have a list of hardcoded websites that
will only load over https, and therefore, because the browser has to contain this list locally, it
will not contain all the websites on the internet.
It only contains very popular websites such as Twitter, Facebook and GitHub and so on.
Now, we could have a bigger list in here, but it won't be as big as TTPs websites as most websites
use stps.
Now when it comes to HTP, no encryption is used, so there is nothing you need to do to bypass.
So you can basically use the basic better cup, no modifications at all, and it works perfectly with
Firefox and Chrome, so you'll be able to read the data and even modify it as we're going to show you
later on in the course.
Then when it comes to steps and steps, we can't decrypt HTTPS and therefore what we try to do is we
try to downgrade https to, hey, stop.
And then when the website is loading over HTTP, we will be able to read all of the data that is being
sent and received.
So we'll be able to see the usernames and passwords and so on.
And as I'm going to show you later on in the course, you'll be able to modify this data.
So you'll be able to launch attacks like DNS spoofing, where we redirect the domain to another location
or inject code into loaded website.
But all of that is dependent on loading the website in FTP.
Therefore, when it comes to S and hate chests, the goal is always to downgrade that website or downgrade
that connection to HTTP.
So for this to work, we used a custom modified caddy that comes with the latest version of better cap
and a modified heat chests hijack couplet.
This is the couplet that downgrades hasty to hasty types.
And this works perfectly with the latest version of Firefox.
So let me show you a quick example.
We're going to load Buttercup with the yes hijack couplet and then try to load some of these websites.
And the goal is that these websites should load in HTTP, not take steps.
If that happens, that means we can read all of the data and analyze it and we can even modify it,
as I'm going to show you later on in the course.
So right here in my Carli machine, I'm just going to start Buttercup exactly the same way as we usually
do.
I'm select in my interface and my spoof couplet, and then I'm going to start the hijack couplet by
typing stub and it'll autocomplete for me.
I'm going to hit enter and now it's working.
And let's go to the Windows Machine.
And as you can see, it's telling me that I'm using the latest version of Firefox.
And let's go ahead before we test.
I'm just going to remove all browsing data.
So I'm going to press control and delete.
And we're going to take everything, make sure everything is selected in here and click on.
Okay.
And let's go ahead to the first steps website like LinkedIn dot com and perfect.
As you can see, the website is loading over HTTP, not https because we can see this cross over the
log, but most people won't notice this.
And basically, like I said, that means we can read whatever username and password the user will put
in here and we can modify the data and inject data and this and you'll see this later on in the course.
Now, I'm not going to log in now because we have already seen this.
The goal now is just to show you which websites are going to downgrade to HTP and even if you don't
see the log in data now if I log in and you don't see it in Better Buttercup, that is completely fine
because the sniffer that comes with better cup is not perfect.
I will show you better sniffers later on in the course.
So the main goal when we are to use in better cup is to be able to downgrade steps to STP.
So let's load another https website like StackOverflow dot com.
And perfect.
As you can see, it's downgrading as well.
And let's do a last one now.
Let's go to Netflix dot com.
And again perfect.
It's downgrade in its load in over normal http.
So we haven't done anything different from what we covered earlier.
Everything is working perfectly with Firefox now.
When it comes to Chrome, there is a slight modification that we'll need to talk about.
So let's continue testing with Firefox.
So moving on to preloaded websites similar to Twitter, Facebook and GitHub.
Again, for this to work, we're going to have to use the custom really with better cap with the custom
hijack couplet.
Now let's go ahead and test this with Firefox.
So the way this will work, as mentioned in the stress bypass lecture, the target will first have to
load and normal https website.
An example would be a local Google domain.
For example Google dot IGF or Google dot and or Google dot dot UK.
Anything but the google dot com because these know you as normal steps and therefore we will be able
to downgrade them to normal STP.
As you can see in here and then once they are on any website or any search engine that uses normal steps
and we successfully managed to downgrade it to FTP.
If they search for a STC website, for example, Twitter, the steps hijack couple, it is going to
replace the link for Twitter dot com with Twitter dot corn.
Therefore, that will bypass the hardcoded list that the browser comes with because it does not have
an entry for websites that is called Twitter dot corn.
So if I hover my mouse over here, you can notice at the bottom the website that we will go to is Twitter
dot corn and not Twitter.com.
Now this replacement takes a second or two.
So if you hover over it straight away, as soon as the website loads, you might actually notice twitter.com
and then instantly it's going to change to dot corn.
Once it changes, if the user opens this.
You're actually going to get a redirect notice like this one that will not work automatically.
So this is another limitation with this method.
But if the user actually goes ahead and loads the website.
You will notice that we will get a website that is identical to Twitter, which we can use to sign in
or sign up.
But the website is loading over normal http, not https.
And if you know it's Twitter dot corn, not dotcom.
So if the user looks in here, they might be able to notice that something is fishy happening.
But I would say it'll pass most users.
So another the website is loading over normal hash STP.
You can first of all read the data, the user sense, for example, usernames and passwords.
And you'll also be able to manipulate this page and inject eval code in it and we will cover that later
on in the course.
Let's have another example.
So let's close these and let's go ahead and look for Facebook.
Again, Facebook is another example of a website that uses stars.
If we hover over it, you can see already it's been replaced to Facebook dot com and so let's open it
in a new tab and open it again.
And perfect.
As you can see, Facebook loads normally over hasty tip and not high stress or hasty ttps.
Again, once the user logs in, you're going to be able to capture the username and password and you'll
be able to manipulate this page.
So that's everything for Firefox.
He obviously works with no issues at all.
TPS also works with no issues at all.
And he trusts.
You just need to make sure that the target websites are listed in the site's hijack couplet and I show
that and the stars hijack lecture.
So if you don't know how to do that, please revise that.
But as you can see, it's working exactly as expected, as long as the target user accesses the site's
website through a normal TTPs website.
Now in the next lecture, we'll have a quick recap for Chrome, because Chrome is slightly different
and could be slightly trickier.