White Hat Penetration Testing and Ethical Hacking

In this video we will try out a variation of the man-in-the-middle with SSLSTRIP attack that we performed previously. In MITMF, in addition to ARP spoofing and SSLSTRIP, we will also be using the Captive Portal option. Please review the videos listed below, if needed: Bettercap with SSLSTRIP attack - Does it still work ? SSLSTRIP attacks with Bettercap and MITMF - HSTS and Web browsers We saw in the previous videos that websites correctly configured for HSTS, can't be attacked using SSLSTRIP. On the other hand, at this moment, a lot of websites still don't use HSTS or have HSTS incorrectly configured - which leaves those websites vulnerable to man-in-the-middle and SSLSTRIP attacks. Because it is unlikely for a user to browse ONLY correctly configured HSTS websites; an attacker can redirect the SSLSTRIP vulnerable websites to a Captive Portal and trick the user into giving up credentials belonging to websites that can't be attacked directly (for example: social media

During my previous two SSLSTRIP videos, I preferred to use the "old" Bettercap version 1.6.2, instead of the "new" Bettercap version 2.x. Bettercap version 1.6.2 is the version which is currently available into the Kali Linux repository. Bettercap version 2.x can be installed from the following GitHub link:  https://github.com/bettercap/bettercap In this video I will use the latest Bettercap version 2.11 to perform SSLSTRIP MITM attacks against sample HTTPS websites. These are the same websites that we tested with during the previous SSLSTRIP videos: Bettercap with SSLSTRIP attack - Does it still work ? SSLSTRIP attacks with Bettercap and MITMF - more info about HSTS and Web browsers Bettercap 2.x is an awesome tool, but unfortunately it seems to have a few shortcomings when it comes to SSLSTRIP. These SSLSTRIP-related issues were previously raised into the following post: https://github.com/bettercap/bettercap/issues/154 During this video we will experien