Hello everybody and welcome to this tutorial. Today, I'll talk about open...
sorry, not to open, rather instead SSL strips and ARP spoofing. Now attacking
wireless systems is, attacking wireless networks in general, is much more than
just cracking the authentication keys. There are a lot of other options that
you can use, especially in public Wi-Fi, where you can authenticate without
any problems whatsoever. And you can also, once you're in that public Wi-Fi, or
you're within a building that has a Wi-Fi to which people are connecting,
perhaps it's not a public one but it's a company, or you're in a school, or
something like that, as long as you are authenticated to that Wi-Fi you will be
able to listen to all the traffic that goes on, that goes over
that particular Wi-Fi, that's up in the air, however more likely than
not it's gonna be encrypted, and it's not gonna be very useful to you. You'll be
able to see who, most likely you will be able to see who is visiting what somewhere,
but you won't be able to see anything of relevance, really. The problem is the HTTP
protocol which encrypts your web traffic, and once you pass login credentials they
are encrypted. So you can't actually see somebody else's login credentials which
is very problematic. Now, there is a program, it's called SSL strip, which
converts, let me just put it to you this way,
which converts HTTP to HTTPS. Sorry, the other way around. This would
make absolutely no sense for pentesting. HTTPS to HTTP. Basically,
it strips the SSL encryption, hence it is called the SSL strip. And
once it is no longer encrypted, once the data over the network is transmitted
in the form of regular HTTP packets in clear text, you will be able to see the
usernames and passwords of pretty much everybody on the network. Now if they're
using HTTP you'll be able to do this anyway, but,
as I said, very few sites today of importance are using only HTTP protocol.
Usually they have port 443 open for SSL encryption, and you cannot use,
you can capture the data but there isn't really much or anything that you can do
with it. Now HTTPS has been...it's showing cracks,
definitely. There were two Italian people who've claimed to have to
have decoded it, to have decrypted it, but there are still issues to be resolved,
and it's not fully cracked, yet. So you won't be able to read
the information if it is encrypted. And for this purpose today, we will need
several tools, we will need two tools. We will require SSL strip, so just go ahead
and type in yum install SSL, oops, not install. Rather instead, search SSL
strip, and, yep, there we go. So this is what you would need to install. The tool
provides a demonstration of HTTPS stripping attacks. It does much
more than provide a demonstration, but oh, well. Basically, just type in as before
yum install sslstrip, and this is gonna go through...because mine is already
installed, and latest version, nothing will happen, but you can also do this,
-y, and you will not be prompted for any questions during the installation, if you
pass this command. Now the second tool that we're going to use is for
DNS spoofing, because we need to convince the router of our identity, of our
assumed identity so to say. We need to trick it. We need to trick it into
sending us the packets that the user sends to it. This is so we can actually
strip the encryption, re-transmit the packets to the router, and then the
router transmits it over to the internet. I'll explain how this works in a moment,
but before I do there is just one more tool that you need to
acquire. Let me just clear the screen. So yum search dsn. Is it this?
Yep, there we go. It has a bit of a weird name here. Usually it's called
arpspoof on pretty much every other distro out there, but on Fedora it's called
dsniff. And this is another networking tool in which you need to install. Basically, what
we shall be doing today is convincing the router to send us all packets that a
user, that a specific users transmits to the router, they will go back to us from
the router. We will remove the encryption, forward the packets back to the router,
and then the router will only transmit onto the net HTTP packets. Everything
will be in clear text. We will be performing a man-in-the-middle attack, as
this technique falls into that category, and then
we will be able to read the user credentials, and practically take all the
vital information, as they were in clear text, without any sort of problems. Now
before I do this, it is of vital importance of me to stress out that this
is not gonna work always. This is not gonna work out 100% of the
time. With Internet Explorer it's more likely to work than with Firefox or
Chrome, but it's still gonna work on Firefox and Chrome. However, perhaps some
websites like PayPal, they have very strong defenses against it, so it's very
unlikely that is gonna work there. Well, it's 2015 now, probably won't work. I'm giving you
99.99 percent chance that it's not gonna work on PayPal, and about 95%
chance it's not gonna work on Facebook either. But, because people tend to
recycle passwords, and they tend to use exactly the same passwords on multiple
sites, and they use pretty much their email as their login credentials as a
username, you can just take other passwords that
you gather, and then attempt them on the sites where you cannot do this. So that
that can be very convenient, and that is definitely something I would advise you
all against it. If you have one set of passwords for all of
your financial places on the net, another set of passwords for all the irrelevant
places on the net. I would definitely advise you to do that primarily because
these places such as Gmail, or Facebook, or PayPal, they will be better protected.
They will have the latest protection possible, and the passwords you use there
you shouldn't really use on some other websites that don't really have good
protection. Because your credentials will get stolen while
you're doing something on those sites, while you're registering on some forum,
or browsing a forum, or something like that, you definitely shouldn't use the
same password as on your PayPal, and somebody will then just try it on your
PayPal account, there you go. Basically, they've effectively
circumvented all of PayPal's protections, and all the millions of
dollars that they've invested into security systems. Key lesson for this, do
not recycle passwords. I will show you how to, I will begin using this in the
follow up tutorial, but these are just a few basics that we had to cover before
actually digging into this. Now both of these tools, SSL strip and
ARP spoof, are not installed by default on Fedora distributions They are on Kali,
so if you are running a live version of Kali you will have both of these tools
there. But, if you're using Fedora you have to install them as I did. The
installation process is very straightforward, just as I showed you.
Just type in one command for one and the other for the other. The only difference
is the name of the packet, that's it, and it will install, no problems. Once you're
done with that, come back, and we'll actually get to use
it in the follow tutorial. Until then, thank you for watching.