Hello everybody and welcome to this tutorial.
Today, I'll talk about open, sorry not open, rather instead,
SSL strips and ARP spoofing.
Now, attacking wireless systems is, attacking wireless networks in general,
is much more than just cracking the authentication keys.
There are a lot of other options that you can use.
Especially in public wi-fis,
where you can authenticate without any problems whatsoever.
And you can also, once you're in that public wi-fi,
or you're within a building that has a wi-fi to which people are connecting.
Perhaps it's not a public one, but it's a company or you're in a school or
something like that.
As long as you are authenticated to that wi-fi,
you will be able to listen to all the traffic that goes
over that particular wi-fi, that's up in the air.
However, more likely than not,
it's gonna be encrypted, and it's not going to be very useful to you.
You'll be able to see who, most likely you'll be able to see who's visiting
what somewhere, but you won't be able to see anything of relevance really.
The problem is, the HTTPS protocol, which encrypts your web traffic,
and once you pass login credentials, they are encrypted.
So you can't actually see somebody else's login credentials,
which is very problematic.
Now, there is a program, it's called SSL strip,
which converts, let me just put it to you this way,
which converts HTTP to HTTPS.
Sorry, the other way around.
This would make absolutely no sense for pen testing.
HTTPS to HTTP.
Basically it strips this SSL inscription.
Hence it's called the SSL strip.
And once it is no longer encrypted, once the data over the network is
transmitted in the form of regular HTTP packets in clear text, you will
be able to see user names and passwords of pretty much everybody on the network.
Now if their using HTTP you'll be able to do this anyway.
But as I said, very few sites today of importance are using only HTTP protocol.
Usually they have a port 443 open for SSL encryption.
And you can capture the data, but
there isn't really much or anything that you can do with it.
Now HTTPS has been, it's showing cracks, definitely.
There were two Italian people who've claimed to have decoded it,
to have decrypted it, but there are still issues to be resolved and it's not fully
cracked yet, so you won't be able to read information if it is encrypted.
And for this purpose today, we will need several tools, we will need two tools.
We will require SSL strip, so just go ahead and
type in yum install SSL, not install, rather instead search.
Search SSL strip and yup, there we go.
So this is what you would need to install.
The tool provides a demonstration of HTTPS stripping attacks.
It does much more than provide a demonstration, but oh well.
Basically, just type in as before,
yum install sslstrip, and this is gonna go through,
because mine is already installed and latest version.
Nothing will happen but you can also do this dash y and you will not be
prompted for any questions during the installation if you pass this command.
Now the second tool that we are going to use is for DNS spoofing.
Because we need to convince the router of our assumed identity, so
to say, we need to trick it.
We need to trick it into sending us the packets that the user sends to it.
This is so we can actually strip the encryption, retransmit
the packet through the router, and then the router transmits it over the internet.
I will explain how this works in a moment, but
before I do there is just one more tool that you need to acquire.
Let's clear the screen.
So yum search dsn.
Is it this?
Yep, there we go.
It has a bit of a weird name here.
Usually it's called ARP spoof on pretty much every other distro out there,
but on Fedora it's called dsniff.
And this is another networking tool which you need to install.
Basically, what we shall be doing today is convincing the router to
send us all packets that a specific user transmits to the router.
They will go back to us from the router.
We will remove the encryption, forward the packets back to the router and
then the router will only transmit onto the net HTTP packets.
Everything will be in clear text.
We will be performing a man in the middle attack as this technique
falls definitely into that category and then we will be able to
read the user credentials and practically take all the vital
information as they were in clear text without any sort of problems.
Now, before I do this it is of vital importance for
me to stress out that this is not going to work always.
This is not going to work 100% of the time.
With Internet Explorer it's more likely to work than with Firefox or Chrome.
But it's still going to work in Firefox and Chrome, however,
perhaps some websites like PayPal, they have very strong defenses against it,
so it's very unlikely that it's gonna work there.
Well, 2015 now, probably won't work.
I'm giving 99.9% chance that it's not going to work on PayPal,
and about 95% chance that it's not going to work on Facebook either.
But, because people tend to recycle passwords,
and they tend to use exactly the same passwords on multiple sites,
and they use, pretty much, their emails as their login credentials,
as their user name, you can just take other passwords that you gather and
then attempt them on the sites where you cannot do this.
So that can be very convenient and
that is definitely something I would advise you all against it.
If you have, you can have one set of passwords for
all of your financial places on the net.
Another set of passwords for all the irrelevant places on the net.
I would definitely advise you to do that primarily because,
these places such as Gmail, or Facebook, or PayPal, they will be better protected.
They will have the latest protection possible.
And the passwords you use there, you shouldn't really use
on some other websites that don't really have a good protection because
your credentials will get stolen while you're doing something on those sites.
While your registering on some forum or browsing a forum or something like that.
You definitely shouldn't use the same password as on your PayPal.
And somebody will then just try it on your PayPal account, there you go.
Basically they've effectively circumvented all the people's protections and
all the millions of dollars that they've invested into security systems.
Keyless in for this do not recycle passwords I will show you how to,
I will begin using this in the follow up tutorial.
But these are just a few basics that we had to
cover before actually digging into this.
Now both of these tools, SSL strip and
ARP Spoof are not installed by default on Fedora Distribution.
They are on Kali, so
if you are running a live version of Kali you will have both of these tools there.
But if you're using Fedora you have to install them as I did.
The installation process is very straight forward just as I showed you.
Just type in one command for one and the other for the other.
The only difference is the name of the packet, that's it and
it will install, no problems.
Once you're done with that,
come back and we'll actually get to use it in the follow up tutorial.
Until then, thank you for watching.