‫Instructor: Hi. Now within this lecture
‫we are going to test our attack.
‫It's working actually right now
‫so I can get the data from my phone, my computer
‫my Kali Linux is actually man in the middle right now.
‫So net.sniff is working.
‫So let's try this.
‫Let's go to browser.
‫Okay, so I'm inside a website over here.
‫So let me go to some other website
‫like an HTTP website maybe.
‫So this is hurriyet.com and it's a local Turkish newspaper
‫so you don't have to go into that, okay?
‫You can just try any website.
‫I'm just trying to see
‫if I can get this information on the left hand side.
‫So as you can see, I'm getting the information.
‫Okay, once I got that
‫so you can try this website for example unicornitems.com
‫but as you can see on the left hand side on my terminal
‫I can get the information, right?
‫So if you go to unicornitems.com
‫and if you go to my account,
‫you can see a login page like username and password.
‫So this is my own website.
‫I just make it available for the tests.
‫So I'm going to say, "testtesttest", for username
‫and I'm going to say "123456123456"
‫for password.
‫And I'm going to try and log in.
‫Of course it will give me an error
‫because that user doesn't exist,
‫But the reason that I'm doing that is to see
‫if I can get this information on my terminal.
‫So since I'm man in the middle, okay, and
‫since I'm doing an ARP sniffing over here
‫I should get this information
‫and if you search for the account name
‫and password that you have given, you will see it like this.
‫As you can see, we managed to get the username and password
‫so it will take a little bit time to find this
‫in all of these logs, but we managed to get it, right?
‫So it was an HTTP website rather than an HTTPS.
‫And I'm going to explain the difference in a minute.
‫However, we managed to get the username and password
‫so it works much better in computers as I said before.
‫So there is a lot more to learn in man in the middle attacks
‫like DNS spoofing, maybe JavaScript injection,
‫and HTTPS downgrades, and HSTS cracking attempts
‫and everything.
‫And we do all of those things in the complete ethical
‫hacking course because we generally target the
‫actual computers in that course.
‫It works in the mobile devices as well but,
‫it has a limit. It doesn't work in apps
‫generally, it works in the browsers, okay?
‫So less people use browsers right now rather
‫than they always go for the apps
‫and it doesn't make sense to allocate too much time
‫on these sections kind of over here, just so that you know
‫there is something called man in the middle attacks, okay?
‫You don't have to spend too much time on it.
‫So if you come to my webpage for example
‫like atilsam.com, you will see it uses HTTPS and if you go
‫to unicornitems.com on your computer it says not secure
‫it doesn't use HTTPS, okay?
‫It starts with HTTP.
‫So of course it's different in HTTPS
‫and HTTP because in HTTPS it's secure HTTP and
‫it encrypts the information that is being sent or retrieved.
‫Okay? So that was the thing that I was talking about.
‫Even though we can get the packets that that is being sent
‫to HTTPS websites, we cannot see the content of them.
‫So it doesn't make sense to capture the HTTPS packets
‫because we cannot see what's inside.
‫So we could have seen the HTTP websites like we
‫did see in the unicornitems.com example, right?
‫But if it was an HTTPS website, we couldn't have seen it.
‫So there are some certain ways to downgrade
‫HTTPS to HTTP as well.
‫We use something called SSL strip.
‫We use some caplets in bettercap in order to
‫achieve this result.
‫However, it doesn't make sense to learn all of these
‫things because it doesn't work very good in mobile devices.
‫Rather, in this section I believe we should focus
‫on how to protect ourselves against these attacks.
‫For example if you are a developer now you should understand
‫why you shouldn't use HTTP connections in your app.
‫Believe it or not, up until three years ago
‫I believe Instagram wasn't using HTTPS connections
‫they were using HTTP connections.
‫So let me show you an example.
‫I'm inside one of the apps that I have written
‫for my iOS course, so you don't have to do that
‫of course I'm going to open this
‫and this is a currency converter app.
‫So all it does is get the currency data from some API
‫and display to them to the user like this, okay?
‫So you can see what your currency is here at this point.
‫Like it's, I believe the base is euro over here
‫and one euro equals to $1.10 right now.
‫So if I come over here, if I see the strength
‫it uses an HTTP connection, okay?
‫So if an app uses an HTTP connection
‫we can see the the data of this app as well.
‫If we attack a mobile device
‫and if I come over here to info.plist
‫I can see that I for Allow Arbitrary Loads option
‫I changed it to yes because I need to change it to yes
‫in order to use an HTTP connection in my app.
‫So Apple basically said that yeah
‫you cannot use an HTTP connection anymore
‫but since there are millions of people using
‫millions of developers using HTTP connections every day
‫they couldn't go for it 100%.
‫So they said that yeah
‫we suggest you go to HTTPS connections right now
‫but if you want to use an HTTP connection
‫you have to come over here and say
‫Allow Arbitrary Loads is yes on your info.plist.
‫So if you are doing a reverse engineering for
‫any kind of app, if you see Allow Arbitrary Loads is yes
‫then you should know that this is using HTTP
‫connection and it's not very secure to do so.
‫It's the same thing in Android as well.
‫Okay? You can use HTTP connections in android
‫development and let me come over here to my
‫currency and let me show you the link.
‫As you can see, the link of this app is over
‫here and I have an Android version of this as well.
‫So you're more than welcome to download it and try it
‫if you want.
‫I'm just going to show you something on the Android as well
‫so we can understand it in a better way.
‫So the thing that you should understand from the section
‫if you're a developer, you shouldn't use HTTP websites.
‫HTTP APIs, if they're not very vital, just switch to HTTPS.
‫And if you are a user, just don't connect
‫to the wireless networks that you are not familiar with.
‫For example if you are at a restaurant, just don't connect
‫to them, just don't connect to their wireless networks.
‫It's not very safe.
‫You can be ARP spoofed, they can see the things
‫that you're doing on the internet.
‫They can get your information, just don't do it.
‫As you can see in the Android as well, I have this HTTP site
‫over here.
‫So in the Android manifest, I have this network
‫security config and usesCleartextTraffic true.
‫So this is the same thing
‫like we changed the info.plist in the iOS and
‫we change this in Android.
‫So if you're doing an reverse engineering on an Android app
‫and if you see this usesCleartextTraffic
‫as true and network security configuration has been changed
‫then you should understand that it's using HTTP connection.
‫It's one of the vulnerabilities that this app should have.
‫Okay, so again, if you come
‫over to network security config over here
‫you can see it says that clear text traffic permitted
‫true and it includes some kind of domains over here
‫and even it includes some sub domains as well.
‫So as you can see, both on Android and iOS
‫don't suggest using HTTP connections
‫because of these reasons and it's still available
‫for developers to use, so don't do that.
‫If you can just switch it to HTTPS
‫just make sure you do it.
‫So I hope you enjoyed this section as well.
‫Meet you in the next one.