4 ms·

In what world is the author living that "Physically go to the same place as her, connect to the same WiFi, and steal her browser session" would work?

by vhcr 4y ago

4gotunameagain 4y ago
presumably part of the challenge was to do it without using already known information, as he probably already had her email and phone number but still looked for them
- vhcr 4y ago
  What I mean is that stealing cookies over Wi-Fi hasn't been a thing for a long time because of HTTPS.
  - brycedriesenga 4y ago
    Haha, I remember messing with it on campus WiFi, but that was probably like 2010. I think the Firefox extension I used was Firesheep.
  - 4gotunameagain 4y ago
    ah sorry, didn't understand it correctly. sslstrip used to be a thing, is it still ? I haven't been in touch with the status quo
    - deleted 4y ago
      [deleted]
    - Taywee 4y ago
      sslstrip doesn't crack ssl, it MitMs non-ssl HTTP responses to switch https to MitM http addresses. If you start on HTTPS and never access plain HTTP resources, it's powerless, otherwise there would be no way to be safe on a public network at all.
      - cmeacham98 4y ago
        I just typed catb.org (random website I know only serves HTTP) into Chrome's address bar and it landed me on the HTTP version, no warnings or anything. I assume Firefox works the same, but I can't be bothered to disable HTTPS-only mode. sslstrip will still work today on any website that doesn't use HSTS. It will work for the first ever visit (by that browser) of a website that uses HSTS if they aren't on the preload list. A surprising number of websites have neither.
        Taywee 4y ago
        That's assuming the average internet user types a url into their address bar instead of using their browser's "new tab page" with recent sites (all probably HTTPS) and finding non-history pages through a search engine that will be HTTPS by default and point mostly to HTTPS endpoints. So yes, you can catch a subset of users who type new urls into their address bar, but that's a minority of people a minority of the time.
  - Logans_Run 4y ago
    Ah. I see what you mean now. Ignore what I said above but will leave it up for context.
itsthecourier 4y ago
That's why you should always use AP isolation in your router. Protecting yourself from ARP spoofing
Logans_Run 4y ago
Perhaps in the world where you (the red-teamer) sets up their phone and/or laptop as an unencrypted/open wifi hotspot access point and then follow them (the blue-teamer) to their favorite coffee spot / burger bar / etc? If I recall correctly even current phones will connect to open wi-fi spots preferentially and/or automatically. Bingo, job MITM done! Bonus points for having a tool on the red-teamers' laptop that can send wi-fi de-auth packets :) That would be the first thing I would look in to to see if it is still do-able today if the problem was 'hmmmmm. Given the parameters, how could I MITM the blue-teamer?' I'm sure that others can come up with even wilder ideas involving can-tennas or bird-dogging the blue-teamer into a elevator with a 'running useful and interesting stuff' laptop in a backpack and wait for the blue-teamers' cell phone to start reaching out desperately for a way to remain connected (cell tower, wifi, 2G cell signal etc) either of which might work
- runnerup 4y ago
  With HTTPS a lot of this doesn't work anymore. You generally need to install a MITM certificate on the target device so that it doesn't say "HEY EVERY WEBSITE YOU VISIT HAS A CERTIFICATE ISSUE!" and fail to load unless you find an esoteric button/link/series of clicks that lets you load the insecure page.
  - ospray 4y ago
    As a pen tester this ^, controlling the network doesn't help for browser stuff. The fastest way is usually phishing.
    - hsbauauvhabzb 4y ago
      You can capture netntlm hashes if you control the network, but you’d still have to crack them. HSTS and secure cookie flags help a lot with sslstrip type attacks though.
moffkalast 4y ago
Living back in the ancient world of 2017. I think they still had CRTs back then.
deleted 4y ago
[deleted]

In what world is the author living that "Physically go to the same place as her, connect to the same WiFi, and steal her browser session" would work?

by vhcr 4y ago

In what world is the author living that "Physically go to the same place as her, connect to the same WiFi, and steal her browser session" would work?

4gotunameagain 4y ago

presumably part of the challenge was to do it without using already known information, as he probably already had her email and phone number but still looked for them

vhcr 4y ago
What I mean is that stealing cookies over Wi-Fi hasn't been a thing for a long time because of HTTPS.
- brycedriesenga 4y ago
  Haha, I remember messing with it on campus WiFi, but that was probably like 2010. I think the Firefox extension I used was Firesheep.
- 4gotunameagain 4y ago
  ah sorry, didn't understand it correctly. sslstrip used to be a thing, is it still ? I haven't been in touch with the status quo
  - deleted 4y ago
    [deleted]
  - Taywee 4y ago
    sslstrip doesn't crack ssl, it MitMs non-ssl HTTP responses to switch https to MitM http addresses. If you start on HTTPS and never access plain HTTP resources, it's powerless, otherwise there would be no way to be safe on a public network at all.
    - cmeacham98 4y ago
      I just typed catb.org (random website I know only serves HTTP) into Chrome's address bar and it landed me on the HTTP version, no warnings or anything. I assume Firefox works the same, but I can't be bothered to disable HTTPS-only mode. sslstrip will still work today on any website that doesn't use HSTS. It will work for the first ever visit (by that browser) of a website that uses HSTS if they aren't on the preload list. A surprising number of websites have neither.
      - Taywee 4y ago
        That's assuming the average internet user types a url into their address bar instead of using their browser's "new tab page" with recent sites (all probably HTTPS) and finding non-history pages through a search engine that will be HTTPS by default and point mostly to HTTPS endpoints. So yes, you can catch a subset of users who type new urls into their address bar, but that's a minority of people a minority of the time.
- Logans_Run 4y ago
  Ah. I see what you mean now. Ignore what I said above but will leave it up for context.

itsthecourier 4y ago

That's why you should always use AP isolation in your router. Protecting yourself from ARP spoofing

Logans_Run 4y ago

Perhaps in the world where you (the red-teamer) sets up their phone and/or laptop as an unencrypted/open wifi hotspot access point and then follow them (the blue-teamer) to their favorite coffee spot / burger bar / etc? If I recall correctly even current phones will connect to open wi-fi spots preferentially and/or automatically. Bingo, job MITM done! Bonus points for having a tool on the red-teamers' laptop that can send wi-fi de-auth packets :) That would be the first thing I would look in to to see if it is still do-able today if the problem was 'hmmmmm. Given the parameters, how could I MITM the blue-teamer?' I'm sure that others can come up with even wilder ideas involving can-tennas or bird-dogging the blue-teamer into a elevator with a 'running useful and interesting stuff' laptop in a backpack and wait for the blue-teamers' cell phone to start reaching out desperately for a way to remain connected (cell tower, wifi, 2G cell signal etc) either of which might work

runnerup 4y ago
With HTTPS a lot of this doesn't work anymore. You generally need to install a MITM certificate on the target device so that it doesn't say "HEY EVERY WEBSITE YOU VISIT HAS A CERTIFICATE ISSUE!" and fail to load unless you find an esoteric button/link/series of clicks that lets you load the insecure page.
- ospray 4y ago
  As a pen tester this ^, controlling the network doesn't help for browser stuff. The fastest way is usually phishing.
  - hsbauauvhabzb 4y ago
    You can capture netntlm hashes if you control the network, but you’d still have to crack them. HSTS and secure cookie flags help a lot with sslstrip type attacks though.

moffkalast 4y ago

Living back in the ancient world of 2017. I think they still had CRTs back then.

deleted 4y ago

[deleted]