View source for MITM Labs/Bettercap to Replace Images

=Replacing Images in Web Traffic=

==The setup==

We have a sheep connected to wifi. The sheep is going to be man in the middle attacked by the attacker, who will pretend to be the gateway to the sheep, and pretend to be the sheep to the gateway. Then the attacker will use this control of the traffic to modify HTTP content returned to the sheep, and replace all images with this one:

[[Image:Ohai.jpg|300px]]

==Materials==

Get the custom ruby proxy module to replace images with a custom image:

<pre>
$ wget https://raw.githubusercontent.com/evilsocket/bettercap-proxy-modules/master/http/replace_images.rb
</pre>

(see [[Man in the Middle/Traffic Injection]] for more info).

Now you have <code>replace_images.rb</code> in a given directory with your materials and logs and scripts.

Make a directory that will contain the image you're going to serve up in place of the old images. This will be called img/ and will contain an image called hack.jpg.

==Running bettercap==

Now we can run bettercap from this directory, specifying the custom Ruby proxy module with the <code>--proxy-module replace_images</code> argument. You will also need to set the <code>--httpd</code> and <code>--httpd-path</code> options to run an http server, from the directory that contains your hack.jpg image, to serve up the image to the sheep.

The whole thing looks like this:

<pre>
bettercap -I wlan2 -O bettercap_proxy.log -S ARP -X \
    --proxy --proxy-module replace_images \
    --httpd --httpd-path img \
    --gateway 192.168.0.1 --target 192.168.0.7
</pre>

The first line specifies my network device, output file, type of attack, and turns on a sniffer.

The second line turns on the http proxy server, which is what gives me access to the traffic to modify it.

The third line runs a web server on the local machine to host my O HAI image - when we inject it in the sheep's traffic, it will be served up by us. 

The last line specifies the internet gateway and the sheep, via their IP addresses.

==Results==

This worked like a charm. I ran the script on the attacker, closed the browser on the sheep, gave it about 15 seconds, and then opened the browser. It slows down the loading time by a substantial amount - but as you can see, it's worth it:

[[Image:OhaiSuccess.jpg|500px]]

To see more info on how the http proxy works, and how else the traffic can be modified, see the [[Bettercap]] page.

==Observations==

Other observations I made: I could see the tool trying to use the HSTS attack, redirecting requests to wwww.charlesreid1.com. These would fail initially, but when I refreshed, they worked fine - totally transparent. Except for the failure.

HTTPS content was showing up as insecure - for example, an embedded Vimeo player would show up as a minipage with a "Your connection is not secure" error. 

However, for the most part, on the HTTP sites that I tried, the images were replaced and the entire attack worked flawlessly.

==Caveats==

Some caveats: 
* Sheep have to be visiting HTTP sites
* Need to disable HTTPS proxying
* Slows down loading times for the sheep
* The more targeted, the better - definitely.


=Flags=

{{MITMFlag}}