Hello everybody and welcome to this tutorial. Today, I'm gonna go ahead and
start configuring my computer and my network settings, in order to be able to strip
the SSL encryption from various packets that I'm going to redirect to myself.
Anyway, one of the first things that we need to do is take a look at the list of
these commands here. So it's echo 1, to this file here,
let me just show you. I'm gonna copy/paste it. I am deliberately
not giving you the text files from which you can copy/paste.
I mean, I know that it's perhaps tiresome, or something like that, but try
typing the commands in. It does help you a great deal to understand them better.
Because you're gonna make mistakes, and you're gonna correct them, and you will
understand and remember the commands as well. A very good way to remember them is
just to type them in. Also, you will be able to understand a bit more because
you're gonna get error messages that are gonna tell you stuff about it. Anyway, I
have prepared a file for myself here to save us a bit of time today, and to
save myself for making mistakes when typing.
But, anyway, what we need to do is type this in, it says echo 1, and then put it
into this file here. I can go ahead and press ENTER, it's already set to 1,
but it doesn't matter. I can also verify that it is 1 by catting the content, so
it is 1. If you wish to revert it back to the old state just type in 0, and if I type in
cat again it's going to be 0. By default on your machines it will be set to 0, so
you do need to change this. I have done this before so it was already on
1, but it doesn't matter, it does no harm to type it in one more time. Now there is
this rather lengthy command in terms of IP tables configuration. Now
we need to configure our firewall for port forward redirection,
because we need to redirect traffic from a certain
port to a certain port. So from port 80 to the listening port of the SSL strip. And
iptables, as I mentioned before, is a fantastic firewall, completely open
source, and it can be used to conduct extremely complex
operations, and it can be used for the simplest of things. The wonder of it
is that it's free, and that it's very good. Anyway, type in IP...there's also a
graphical interface, but people use it in very rare
occasions. I don't think that is the general approach, usually people prefer
to just type the commands in themselves. Anyway iptables -t nat, nat
is a table for a network address translation. -A, that stands
for append. I could also type in here -I for insert, or -D for delete, but we need
append, and to chain PREROUTING. Excellent! We're gonna specify a protocol,
so it's gonna be tcp, - -destination-port. You can also type in, you can
also use the dport argument, but, I don't know, I suppose for some strange reason
I've opted for destination board. It's a lot easier to understand when looking at
it, it's practically written as though it was literally English language, it is
English language, but I mean how would you tell somebody to
redirect to a certain port? We would tell them redirect to port and then type in a
port. You use the same syntax you would use when telling somebody, a
real person, to redirect something, you would use the same syntax to actually
tell the machine as well. So they've made a great effort
to make it as simple as possible, although at first glance it can seem a
bit complex. So it's tcp, destination-port is 80. And now I need a command that's
gonna be passed, so J, and I want to redirect the traffic. So just type in
REDIRECT --to-port 8080. Now port 8080 is going to be
the port on which the SSL strip will be listening on. Go ahead and press Enter...
there is no output, there is no confirmation, the exit
code is zero, so nothing happens here. And if nothing happens, that's great!
It means it has worked. Not necessarily, but 99% of the cases means
that it has worked. However, I do like to run a verification, and I'm gonna go
ahead and type in iptables -t nat -L, to get a listing, and I want
PREROUTING. I'm gonna see what I've done there. Excellent!
So you see it says redirect TCP from anywhere to anywhere with the
destination port of, you see the port DPT, it's the short version here. So the destination
port is port 80, which is HTTP redirect ports 8080,
excellent! I've already inserted, I have a bad feeling I've inserted this rule
three times by now, because I've done some test runs in order to
not make any mistakes during this tutorial to save us all time, but it
seems to be effective, it seems to be working. So let's just go
ahead and clear the screen. Keep in mind that while you're doing this you're
gonna encounter a lot of problems. There's gonna be error messages, things
are not gonna work, you're gonna need to reinstall some things, install additional
libraries perhaps, or something of a kind. Don't sweat it,
that is all standard procedure. It happens to everybody quite literally, you
just need nerves of steel to go through it. Now I've written for myself here find
a target. Now you can use, I know what target I'm going to attack, but you can
use nmap, and before you use nmap just like an ifconfig...clear, ifconfig
p8p1, excellent! So I just wanted to get a listing
for the interface that I am using, because you need to
be using the interface that you are using to connect to the internet. So this
is the IP address that is assigned to me, usually the default gateway simply the
lowest one, but you can check the default gateway by typing in route, press ENTER,
and there we go. Gateway 192.168.1.1
That would be the IP address of my router within a LAN. Now,
looking at this, I'm guessing that it is assigning IP addresses from 2 to
254, yeah 254 because it cannot assign 255. 255 is the broadcast. Anyway, so from 2 to
254 it's gonna be assigning IP addresses. I can perform an nmap scan of the
network, so nmap, and I'm gonna go ahead and type in
192.168.1.1/24. So please scan the entire subnet, or I can just do
this 2-254 to save myself a couple of IP addresses here, two IP addresses less,
and I want double verbose output. This might take a while. If you are doing it,
this will reveal all the hosts that are up on the network, that nmap can reveal.
I've also told it to scan on all ports as well. However, I mean, yeah, you're gonna
have to do this, basically, if you're in a real life situation, and it's gonna keep
on scanning it, and it says, ok, host down. I only have one host that is up here,
that is up and running, which is my Windows machine, and I'm not gonna go and
sift through all these up. I'm just gonna go ahead over to my VirtualBox and open
up my Windows 8 machine, there you go. So it says scanned host...never mind. Anyway,
you will need to perform this scan if you want to figure out who is alive, but
I've just showed you how to do it. Just do nmap, and if you don't find any hosts
try passing on some different arguments to nmap. Try saying like -Pn, or something
of a kind, and see if that yields any different results. Also, you can use -O
for os detection, and something of a kind. Yeah, there we go. So I'm going to
open up my Windows machine, type in ipconfig into the cmd, yep, it's
ipconfig into the CMD, and I'm going to get a lot of information here. Basically,
I'm only interested to see which IP address is actually assigned to this
machine. It's 100, excellent! So, this machine, this Windows 8.1 virtual machine,
is functioning on 192.168.1.100, and that is my victim. That
is the person, that is the machine that I wish to vandalize, that I want to
actually strip of its encryption, and view its traffic. So I'll just go ahead
and minimize it for the time being, as we know what the IP address is there. And if
you're wondering why I have all these terminals open, we will need two
terminals to perform this attack, and a third one to view the results of the
attack, because we don't want to stop the attack while we are viewing the results.
Anyway, in the follow up tutorial I'm going to go ahead and go
over ARP spoof since we have completely prepared our machine, we have found
our victim. Now we need to do the ARP spoof, and we need to conduct an SSL
strip, and then we need to have a live report of the log as well, in order to
pull out some of the valuable information
from it. Anyway, I bid you all farewell, and I hope to see you in the next
tutorial.