Hello and welcome to this tutorial.
This is will be the final one in the series of SSL strip, so let's wrap it up.
Anyway, I'm going to arf spoof basically twice.
I will convince the router that I am Windows 8.1 machine
and I will also convince the Windows 8.1 machine that I am the router as well.
Now this is the case that I have a virtual machine here, but it doesn't really matter.
It would work just the same with pretty much any other device
that is connected to this particular wireless network.
The procedure is exactly the same.
There are literally no differences whatsoever.
Anyway, this is the default gateway
Meaning that is my router and this is the IP address of my Windows machine.
I know what it is now, but I've shown you can use nmap to see the live hosts on the network
and you can use -O argument to perform operating system detection
and you can see which sort of devices are on the network.
Anyway, let's go ahead and issue this command
and later on, I have one more thing to show you with IP tables.
I've been struggling around with that.
It didn't wanna work for a while for some strange reason
but then I really figured it out what it was.
Let me just see what I actually typed in here.
There is a command that you need to run.
You need to open up a port manually in the IP tables
and that would be port 8080.
Okay, so router is first here.
Excellent
and Windows 8.1 machine is first here.
So now I am effectively performing the arf spoofing action.
I need to do it twice
and I guarantee you it's going to be effective this way
but here's what I wanted to show you.
Here's what I've been struggling with.
The thing that I've been having problems with.
The port on my machine from which I'm performing the attack, port 8080, was not open.
Even though an application was listening, it was not permitted by IP tables to receive any sort of traffic on it
and that presented a pretty big problem
because now my arf poisoning effectively DoS'd a wireless network.
By poisoning the arf, I have effectively rendered the host that I am messing around with...
not the host, the victim machine that I am messing around with, connectionless.
It could no longer function properly, it could no longer interact with that wifi in a proper way
and it no longer had an exit point onto the internet.
So what I did was manually correct the problem.
I typed in "iptables -I INPUT"
and I'm going to insert to the first position
because it's very important with these rules, the positions themselves
the Linux will start interpreting the rules from the first to the last.
If they contradict each other or something like that
the first one in the order will take precedence always.
Input 1, and I need the protocol. It's going to be "tcp -- dport" -- This is a shortcut
and the dport will be 8080, the one that we specified.
You also specify different ports here, depending on what you specified on the redirect rule.
So you can use pretty much use any port there as well
that is not being used for anything else.
Anyway, let's just go ahead and type in dport there
"-j ACCEPT"
and this is the command which you need to run for IP tables as well
in order to open up this port here, so that the SSL strip could be listening.
I'm not going to do it now because I already have it.
Let me just show it to you -- "iptables -L INPUT"
Well, what do you know. It's not actually there.
No problems, we'll just go through it again.
I must have performed reset quite recently, but it doesn't really matter.
I can just do it really fast.
"...INPUT 1 -p tcp --dport 8080 -j ACCEPT"
Excellent. There we go
and now I can do the listing.
ACCEPT, tcp, source -- anywhere, destination -- anywhere
It says here webcache, but it's 80
Anyway, let's just go ahead and clear the screen.
Now I need to type in "sslstrip -l 8080"
Now keep in mind any that changes that you make in this fashion to the IP tables, to the firewall
are not permanent.
The first reset of the firewall, or the first reset of the machine as well
will pretty much restore the default settings.
They are not permanent changes, so I must have reset it or something like that
reset the service itself, the firewall service, and I've lost a rule
but it doesn't really matter.
Let me just go ahead and start the ssl strip and listen on port 8080
press ENTER, and there we go.
It is now effectively listening.
Now I'm not going to monitor this
because this is going to share some sort of information anyway that I'm not gonna be that interested in.
What I want is to type in "tail - sslstrip.log"
Press ENTER
tail -f will provide a live feed of any changes done to this file and sslstrip
Pretty much whatever passwords or usernames it manages to grab, it puts into this log file
and I want to monitor it, I want to see when things pop there.
Let's go over to my virtual machine -- Windows 8.1
I have it right here
Anyway, let's just go ahead and open up Firefox
and I'm gonna open Internet Explorer as well.
I will show you the difference between the two.
Some of the things will work on Internet Explorer
while those same things will not work on Firefox
primarily because they have different safeguards in place
and I'm not usually overly critical of Microsoft
because they've done a wonderful job with the security in Windows 8
but they've done a terrible job with design there.
However, Internet Explorer still remains one of the most vulnerable browsers out there.
I do not understand why.
There you go
This is actually a tailing part.
You can see what sort of information is being passed here.
This is kinda difficult to read. It doesn't really make that much sense.
I mean, I couldn't read this.
Maybe I could, but only portions of it
and it would take me a very long time to figure out what all of it actually means and represents
but you are only looking for certain types of fields that have very specific names.
So let's go over to Google
I am wondering will it actually open Google
Surely enough, it actually opens it up
So Google search engine actually works with this.
Let's try Gmail
Will it be able to open up Gmail?
and yes it will, but it will be encrypted.
Let's see, will I manage to take the credentials?
I'm going say FAKE, fake
Okay, it says incorrect
but since I am still going over the encrypted protocols, this is not gonna work.
Okay, no problems. Let's give it a shot here
and let's see if this is gonna work on Internet Explorer.
Yes it will, because immediately here you see that it's HTTP protocol
and let's see if this is gonna catch it
SO FAKE, fake, sign in, and there we go.
It actually did catch it.
So the user name is actually "email", which is correct.
So email equals FAKE, and password equals fake.
Surprisingly enough, it doesn't work on Firefox
and usually if it doesn't work for Firefox, it's not gonna work with Chrome
but there is always a chance, a slight chance
With Explorer, it does work
and let me tell you this, 30% of the world's population still uses Internet Explorer.
Out of that 30%, a good amount of them does not perform regular updates
and even better, vast majority of that 30% are actually people in the corporate world
in the companies were you have a computer from the company
and you are forced to use certain programs, certain browsers, and operate under certain settings
and those are usually the kind of targets that pen testers go for
when they get the permission to do something of a kind
which is fantastic
primarily because they are using Internet Explorer, as it is extremely vulnerable.
So let's just try a few more pages and see how this works out.
Let's see if we can get to Facebook.
Okay, I'm gonna try Facebook on Explorer and I'm gonna try Facebook on Firefox.
I didn't install the Chrome here because pretty much the same rules apply with Firefox.
They're state of the art browsers
and you see, it doesn't work with Facebook.
I'm not even going to try because...ah, I might as well try since I'm here.
It's still HTTPS, but down here with the Explorer
it's HTTP, and you'll be able to take it.
So let's give it a shot. Why not?
Facebook
and surely enough...
I should have it here somewhere, let me just see...
It's fairly difficult to see
Oh, I just had it...I had it
There we go
So "email=FACEBOOK", and "pass=FACEBOOK"
So over on Internet Explorer, I have managed to steal the credentials.
Let's go ahead and see whether or not I'm going to be able to do it in Firefox
No, but let's try anyway.
Um no, this is definitely not going to work.
Let's just try it one more time.
Um, what am I going to type in here?
Nothing has changed here, so it didn't actually managed to capture it.
There was no stripping of this S, and the traffic unfortunately is still encrypted here.
So we can't actually use Facebook for that, but let's try some different sites.
Let's try PayPal
That's one of the most common sites to receive attacks.
No, I don't want Bing. I want PayPal.
Amazing...amazing
Why are you doing this to me?
Will it open? Well, what do you know! It actually does!
and it's running under HTTP protocol, which means username and password is in clear text
which is fantastic.
I do believe that I have this version of Windows updated to the max.
Do I? Yup, there are no notifications regarding updates.
So it is updated to the final version, along with the Internet Explorer
and let's see if it actually works on Firefox.
Purely doubt it, but I'm going to give it a shot anyway because I like trying things out.
No, no it doesn't.
Actually there is an S there, and this will not work.
So let's try Firefox.
Will it gives me anything? No, it will not.
Let's see Explorer
Yup, there we go.
It's definitely somewhere in here.
Okay, so let's go over to some less protected sites.
Let's just give it a shot
I'm gonna go over to Linux.org
Wait, not Linux.org
Linuxquestions.org
This is a fantastic website to get pretty much any answers out there
and let's do the same here.
Let's go over to the official site
and no
This is in clear text anyway
but anyway, they don't really need to add any extra security there
because, I don't know, nobody's gonna steal these passwords.
There's no money here.
This is purely for educational purposes and people trade knowledge here
but anyway, it is a good site to actually visit.
If you have any problems, you can ask people there pretty much anything related to Linux
and more often than not, you'll find people willing to help you out.
Anyway, I hope I've given you a few clear demonstrations of what you can do here
and just in case you are thinking that you cannot do anything with Firefox or Chrome
well, you're badly mistaken, primarily because yes you can.
Chrome and Firefox are both susceptible to sslstrip, but not on all sites.
It won't work, for example
it won't work on PayPal, it won't work on Google, it won't work on Facebook
but as you have seen on Explorer, it will work on pretty much anything.
So if you're lucky enough, your victim is using Internet Explorer
and you have a 30% that they are, which is there not bad odds at all.
You will be able to pretty much steal all the credentials.
Especially important with the rise of the Windows phone, who also uses Internet Explorer.
However, Firefox and Chrome will be vulnerable
if people try to log in into some less secure sites somewhere else
that are also functioning under HTTPS protocol, where the S gets stripped
the SSL encryption.
However, there are no extra safeguards
and you can actually steal the log in credentials there
and as I said before, people usually tend to recycle them and reuse them
so you have a very good chance that they are the same.
In any case, I bid you all farewell.
I hope that you have enjoyed this tutorial
and with this, I will conclude this chapter
and of course, I really do hope to see you in the next tutorial
but until then, I urge you to experiment on your own, of course
within the limits of the law.
Anyway, I hope to see you next time.