Instructor: In the pervious lectures,
we learned how to detect ARP spoofing attacks
by manually analyzing the ARP tables.
We also learned how to install tools
such as Xarp to automatically detect ARP spoofing attacks
without having to manually check the ARP tables
and we even learned
how to detect other suspicious activities using Wireshark.
Now, this is really good but still has a few problems.
First of all, we're only talking about detection,
so even when we detect that someone
is intercepting the connection,
we can't really do much,
all we could so is simply disconnect
from the network, maybe change its password if we can,
if we're on the network to something that's more difficult
or if this is a public network
such as a airport, a hotel or a college network,
then all we can do is simply just disconnect
and use a different network
because we can change its password.
The other problem with the previous methods,
like I said, they're only detection methods,
therefore they'll only work if the target manage
to become the man-in-the-middle using ARP spoofing.
But what if someone is able
to intercept the connection using another method?
For example, if someone is running a fake access point,
like I showed you earlier,
and you connected to this fake access point?
Or if you connected to a hotel, a college,
a public Wi-Fi network, a cafe network
and the admin of that network
is actually collecting data or someone
or a hacker gained access to the admin's computer
and again is analyzing the data
because by default, in fake networks
and in any network,
the admin is able to see the traffic
because the traffic will have to go through their server
or through their router.
So the detection methods
that I showed you earlier won't even work against this.
Therefore, in this lecture,
I wanna discuss two solutions to this problem
so the idea is you use these solutions
if you discover that you're being attacked
or if you're connecting to a network
that you don't own and manage yourself.
So if you're connecting to a college network,
an airport network, a cafe network,
or any other network
that you yourself don't have control over.
The solution to all of this
is to encrypt your traffic.
If you encrypt your traffic,
we don't really care if somebody is able
to intercept this traffic
because our traffic is going to be encrypted,
therefore it'll be gibberish
and it won't be useful to anybody
that is intercepting our traffic.
So there are a number of ways to so this
and I'll explain how they work as we go through it.
So let me show you this in action.
Right here, I'm already running Bettercap
and as you can see, it's already getting information.
And right here is my target
and we're already on Vulnweb
and if we just click on anything just to show you,
you'll see the domain is gonna be detected in here.
And then let's just quickly log in.
You'll see this login attempt will be detected
so we have the username is admin
and the password is testtesttest.
Again, if we try, I'll just open a new tab
and go to Stack Overflow,
you'll see it'll load over HTTP, not hTTPS,
so again, if I go ahead and log in,
I'll be able to log in and detect the password
and the HSTS method that I showed you earlier,
again it'll work and we'll be able to bypass that
and steal the password.
So right, this Kali machine
is able to intercept all the data
that is sent to and from my Windows machine right here.
So the first method to prevent these attacks
and we don't care if we're being attacked,
again, I'm not running Xarp, I'm not managing my ARP tables,
I don't care if someone intercepts my data.
Wheat I'm gonna do is I'm gonna install a plugin
on my browser called HTTPS Everywhere.
So I'm gonna be installing it on Firefox.
I'll include its link in the resources of this lecture,
but there is an equivalent of this plugin
for most browsers such as Chrome and others.
All we have to do is simply click on Add to Firefox
or Add to Browser, whatever browser you use.
We're gonna click on Add in here.
And that's it, the plugin is added in here.
As you can see, I'm gonna click on OK
and we can manage it here from its icon on the top right.
So as you can see right here now it's set to off
and if I click this,
I will turn on this plugin
and basically what this plugin will do,
you can think of it as if it adds HSTS support
to more websites, pretty much to any website
that uses HTTPS.
Therefore, for example,
when I try to access stack Overflow in here,
I was able to downgrade it
because my browser does not know
that this website should be loaded over HTTPS
and Bettercap was downgrading the HTTPS requests to HTTP
like I explained in previous lectures.
What this plugin will do,
similar to HSTS, it has a list of websites
that support HTTPS
and therefore when we try to downgrade the HTTPS connection
of this website to a HTTP connection,
it'll tell the browser no, don't do that
and it will upgrade it again back
to a HTTPS connection.
So let me show you.
I'm just gonna delete the history
and I'm gonna load Stack Overflow again
and perfect, as you can see,
it's loading with HTTPS in here.
Therefore now if I go and log in,
my information will be encrypted and therefore the hacker
won't be able to see my username and password.
So that's really, really good
but not perfect.
Let me tell you why it's not perfect.
First of all, if we go back to a HTTP website,
again similar to what we have in here in Vulnweb,
so I'm just gonna log out
and we'll log in again with another password.
I'll just put the password now to 1234567890.
We'll log in
and if we go back here to the logs,
all the way down, you'll see we are still able
to detect the username and the password.
So this plugin is really good for websites
that support HTTPS.
It'll force us to load HTTPS on websites
that support HTTPS
but if you access a website that only uses HTTP
such as Vulnweb, I know there aren't a lot
of websites that do that
but they still exist, so if you access any website
that uses only HTTP, then that website is still open
to the hacker.
So the hacker can still see this information,
they'll still be able to steal usernames and passwords.
If you send usernames and passwords to them.
Not only that but they will also still be able
to replace downloads, serve you fake updates
or inject JavaScript code like we've seen earlier
and get you hooked to Beef.
HTTPS Everywhere also does not prevent the hacker
from seeing the websites that you access
and running DNS spoofing attacks.
Let me show you.
So if I just go to bing.com, for example,
and then let's go to duckduckgo.com,
keep in mind, HTTPS Everywhere is still working
and let's go to the hacker machine
and just look at our logs.
So as you can see, we can still see that our target went
to DuckDuckGo, we can see that the target went to Google.
We can see that the target went to Bing,
so we can still see the domain names
but we can see the data that gets sent
because that'll be encrypted with HTTPS
so there is still some data that the hacker is able to get.
If you want to take your security to the next level
and completely encrypt everything you send and receive,
then you should think about using a VPN.
Therefore, in the next lecture,
I'll explain to you what a VPN is, how it works,
and how it can protect us from hackers
or anybody that intercepts our connection.