MITM Labs/Bettercap Android Evo - Revision history

Admin: /* Results */

2017-09-05T11:19:07Z

Results

← Older revision		Revision as of 11:19, 5 September 2017
Line 53:		Line 53:
	=Results=		=Results=

	Somewhat surprisingly, the phone held up perfectly under the attack.		Somewhat surprisingly, the phone held up perfectly under the attack, and '''the attack failed'''.

	HTTP pages would NOT load on the phone. Apps that required an insecure network connection (e.g., news app) reported a network error. No HTTP traffic could be sniffed.		HTTP pages would NOT load on the phone. Apps that required an insecure network connection (e.g., news app) reported a network error. No HTTP traffic could be sniffed.

2016-08-27T07:41:46Z

2016-08-27T05:26:00Z

Further Notes

← Older revision		Revision as of 05:26, 27 August 2016
Line 59:		Line 59:
	HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack. They made it past the attacker unsniffed and uninterrupted.		HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack. They made it past the attacker unsniffed and uninterrupted.

	=Further Notes=		=Further Notes: MLB Scoreboard Requests=

	~~Tried~~ the same set of attack steps against a newer Android phone, LG G4, with the same results: HTTP was blocked during the MITM attack, while HTTPS made it through the attack unscathed and unsniffed.		I tried the same set of attack steps against a newer Android phone, LG G4, with the same results: HTTP was blocked during the MITM attack, while HTTPS made it through the attack unscathed and unsniffed.

			HOWEVER, on that phone there was an MLB sportsball app, and I saw some of the GET requests from that app going to mlb.com. That traffic could clue in an attacker to the presence of a web app that is a weak point in the security exterior.

	=Flags=		=Flags=

	{{MITMFlag}}		{{MITMFlag}}

2016-08-27T05:23:13Z

Results

← Older revision		Revision as of 05:23, 27 August 2016
Line 51:		Line 51:
	then run [[Wireshark]] on the attacker machine to verify the traffic is flowing your direction. Running an active filter like <code>!arp</code> makes the traffic a lot easier to follow.		then run [[Wireshark]] on the attacker machine to verify the traffic is flowing your direction. Running an active filter like <code>!arp</code> makes the traffic a lot easier to follow.

	==Results==		=Results=

	~~Surprisingly~~, the phone ~~managed to hold~~ up under the attack.		Somewhat surprisingly, the phone held up perfectly under the attack.

	HTTP pages would NOT load. Apps that required an insecure network connection (e.g., news app) reported a network error.		HTTP pages would NOT load on the phone. Apps that required an insecure network connection (e.g., news app) reported a network error. No HTTP traffic could be sniffed.

	HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.		HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack. They made it past the attacker unsniffed and uninterrupted.

	=Further Notes=		=Further Notes=

2016-08-27T05:22:27Z

Results

← Older revision		Revision as of 05:22, 27 August 2016
Line 59:		Line 59:
	HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.		HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.

			=Further Notes=

			Tried the same set of attack steps against a newer Android phone, LG G4, with the same results: HTTP was blocked during the MITM attack, while HTTPS made it through the attack unscathed and unsniffed.

	=Flags=		=Flags=

	{{MITMFlag}}		{{MITMFlag}}

2016-08-27T05:07:10Z

Results

← Older revision		Revision as of 05:07, 27 August 2016
Line 58:		Line 58:

	HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.		HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.



			=Flags=

			{{MITMFlag}}

2016-08-27T05:06:57Z

Hardware

← Older revision		Revision as of 05:06, 27 August 2016
Line 5:		Line 5:
	Conducting an attack with Kali Linux running on a laptop.		Conducting an attack with Kali Linux running on a laptop.

	The target is a sheep running Android on an HTC Evo. The Evo ~~is about two years out of date~~.		The target is a sheep running Android on an HTC Evo. The Evo info:

			Android 2.3.5

			Kernel 2.6.35.10

			Build number 5.07.651

			Browser versoin WebKit/533.1

	==Connect to Wireless with Phone==		==Connect to Wireless with Phone==

2016-08-27T05:05:28Z

MITM with Bettercap

← Older revision		Revision as of 05:05, 27 August 2016
Line 42:		Line 42:

	then run [[Wireshark]] on the attacker machine to verify the traffic is flowing your direction. Running an active filter like <code>!arp</code> makes the traffic a lot easier to follow.		then run [[Wireshark]] on the attacker machine to verify the traffic is flowing your direction. Running an active filter like <code>!arp</code> makes the traffic a lot easier to follow.

			==Results==

			Surprisingly, the phone managed to hold up under the attack.

			HTTP pages would NOT load. Apps that required an insecure network connection (e.g., news app) reported a network error.

			HTTPS services like Google search, large bank website, and map app worked fine and were not vulnerable to the MITM attack.

2016-08-27T04:57:46Z

MITM with Bettercap

← Older revision		Revision as of 04:57, 27 August 2016
Line 41:		Line 41:
	</pre>		</pre>

	then run Wireshark on the attacker machine to verify the traffic is flowing your direction.		then run [[Wireshark]] on the attacker machine to verify the traffic is flowing your direction. Running an active filter like <code>!arp</code> makes the traffic a lot easier to follow.

2016-08-27T04:56:57Z

MITM with Bettercap

← Older revision		Revision as of 04:56, 27 August 2016
Line 38:		Line 38:

	<pre>		<pre>
	$ bettercap		$ bettercap -I wlan1 -O betercap_androidmitm.log -S ARP -X --gateway 192.168.0.1 --target 192.168.0.22
	</pre>		</pre>

			then run Wireshark on the attacker machine to verify the traffic is flowing your direction.