Hello everyone and welcome back, today we’re going to look into THE MOST reliable option on monitoring HTTPS
traffic and seeing it in plain text. It does take a few steps so you aren’t as likely to monitor the network as
easy as you would with Man in the middle. This method i’ll show shows THE MOST data from HTTPS traffic BUT
it does require you to install a certificate on the victim’s machine.
I’ve made two VMs to showcase this attack and they are both at the same network.
To do this attack in a real environment the only thing required would be that you are on the same network with
the victim. Keep things legal , ofcourse, I don’t support illegal stuff.
First let’s look into our internal IPs so we can navigate easier.
Usually you would NMAP the network but since i’m just showing an example this should work great.
Then on KALI we will run our program MITM-WEB which is mitmproxy but the
traffic is visible trough a web interface which is way more friendly and its easier to use.
Make sure you run this with sudo tho, since it didn’t work for me without it.
You can – but don’t have to – change some things in the settings here like I did
- I’ve displayed the event log
- And i’ve checked “Don’t verify server certificates since things work better for me and more things
get caught from what i’ve gathered.
However i dont think you need any of these things to see how the thing that im about to show you works.
Okay now let’s go to the victim machine and in its settings adjust the proxy to be KALI’s internal IP
as well as MITMPROXY’s port which was specified when we started the script. In our case thats 8080
Next we’ll open the browser and install MITMproxy certificate so that most of the HTTPS traffic will
be visible without any encryptions to us.
Follow these simple instructions on how to install it and you are done!
You can also use the command below.
Also before I mentioned MOST of https traffic will be visible without any encryptions:
This is because some sites encrypt the passwords even in sent requests like facebook.
We’ll get to this in a moment…
Now that our certificate is imported and we are listening on the attacker’s machine
Let’s try out some logins !
First we’ll try the ones that DONT work.
Instagram login gives us the username and everything else except the password. As you can see
the password is encrypted, but this isn’t MITMPROXY’s fault – it actually depends on the website.
Next we can try facebook which has the same feature as instagram and you can see that the password is
also encrypted.
Don’t worry tho. You will still be able to capture traffic from MOST of the sites on the internet.
(and yes you can also use this in malware analysis)
Now lets try some sites where we can capture absolutely everything.
Starting off with a random pick: in logitech’s login site i’ll input some random
email and password … aaand…
You can clearly see EVERYTHING that i’ve inputed
How cool is that?
What about linkedin ?
lets try logging in to our “REAL” account
aaand look at thattt
we have capture the password again!
as well as the email ofcourse.
We’ll also try portswigger’s website, enter a random password
And it gets captured.
[IMPORTANT] The reason sites like FB, insta, … dont display the password decrypted is because of client-side encryption they use. Most HTTPS sites in the world, however, dont use this.
So you should be able to capture >95% of https traffic and see it in cleartext.
So anyway before i wrap up this video i’d like to mention you can highlight and filter things easily
on the web interface, and you can also use mitmproxy’s command-line interface if thats what you
prefer.
So what i’ve just shown you is probably the best way to capture HTTPS traffic effectively today.
There aren’t many alternatives and every option is limited – so even this one isnt perfect as you
can see with Facebook.
However picking up passwords from big sites like twitter, linkedin, snapchat and any other site
is a pretty fun thing.
Another thing to mention is i just picked these sites because of their popularity, please DO NOT do
anything illegal, this is for educational purposes only – and for redteams or similar.
That would be all. Subscribe if you like the content, thank you so much for watching
and have a nice day.
[+] images:
