hijacking web 2.0 sites with sslstrip--hands-on training con 17/def con 17... · hijacking web 2.0...
TRANSCRIPT
![Page 1: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/1.jpg)
Hijacking Web 2.0
Sites with SSLstrip
Hands-on Training
![Page 2: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/2.jpg)
Contact
Sam Bowne
Computer Networking and Information
Technology
City College San Francisco
Email: [email protected]
Web: samsclass.info
![Page 3: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/3.jpg)
The Problem
HTTP Page with an HTTPS Logon Button
![Page 4: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/4.jpg)
Proxy Changes HTTPS to
HTTP
Target
Using
Attacker:
Evil Proxy
in the
Middle
To
Internet
HTTP
HTTPS
![Page 5: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/5.jpg)
Ways to Get in the
Middle
![Page 6: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/6.jpg)
Physical Insertion in a Wired
Network
Target
Attacker
To
Internet
![Page 7: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/7.jpg)
Configuring Proxy Server in
the Browser
![Page 8: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/8.jpg)
ARP Poisoning
Redirects Traffic at Layer 2
Sends a lot of false ARP packets on the
LAN
Can be easily detected
DeCaffienateID by IronGeek
http://k78.sl.pt
![Page 9: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/9.jpg)
ARP Request and Reply
Client wants to find Gateway
ARP Request: Who has 192.168.2.1?
ARP Reply:
MAC: 00-30-bd-02-ed-7b has 192.168.2.1
Client Gateway Facebook.com
ARP Request
ARP Reply
![Page 10: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/10.jpg)
ARP Poisoning
Client Gateway Facebook.com
Attacker
ARP Replies: I
am the
Gateway
Traffic to
Forwarded &
Altered Traffic
![Page 11: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/11.jpg)
Demonstration
![Page 12: Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training CON 17/DEF CON 17... · Hijacking Web 2.0 Sites with SSLstrip--Hands-on Training Author: Sam Bowne Subject: Hijacking Web](https://reader034.vdocument.in/reader034/viewer/2022050606/5fade900375dbe6e1c0d2e52/html5/thumbnails/12.jpg)
Do it Yourself
You need a laptop with
Windows host OS
VMware Player or Workstation
Linux Virtual Machine (available on the USB
Hard Drives in the room)
Follow the Handout