So today I'll be teaching you how to intercept all of the requests from your mobile app over into our
hacker application over here.
So the hacker application will be able to pick up all of these requests.
He thinks over here and we can view all of those information.
For example our usernames like passwords and all these different fields before it gets sent over to
the actual website.
And before we go any further, remember hacking is illegal.
If you want to hack, hack me hack Mr. Hacker.
And you know what?
Let's let's hack each other.
So right here we're in color Linux, our ethical hacking operating system, and we're going to launch
Burpsuite as our interceptor.
So I go ahead and enter Burpsuite right here.
And we're now launching the interceptor.
So in the proxy tab of Burpsuite, what we need to set up right here is, for example, a proxy server
that can take in a specific port number as well as a certificate that we can publish or make it available
inside the mobile device.
So if I hit head over to the proxy tab, I can go to Proxy Settings.
And in settings I can add here.
So I add a listener.
So in this situation I can add 8085 and a specific IP address.
In this case we have the IP address of 192.168.0.105.
So this is the IP address of Kali Linux.
I click okay on that.
And what I'll do here is for example I can click regenerate CA certificate.
I can click yes on that import or export CA certificate.
So in this case we're selecting on export certificate in D e format.
Select onto that click next and we will choose a file to export the CA certificate.
So in this situation I have already created one.
But what I'll do is to go in and replace it.
So I'll select on the Sea Cert I'll click save.
Yes, it already exists.
I'm aware.
Click next.
The certificate was successfully exported so I can click close onto that.
Now we need to host and allow the mobile application to download this certificate.
So if I enter LRS we can see that we have see a shirt.
So what I can do in this situation is enter python3 right m httpserver and say port 9000.
So we are hosting this specific directory.
So now we have a mobile device running.
And all I have to do is head over into a specific browser and we can download that.
So let me just go ahead and click more click.
Got it.
So I'll go ahead and enter the following.
In this situation we have 192.168.0.105.
And then followed by port 9000 slash.
Click on that and we'll go ahead and download this one.
So I already have another file but I have to have a new one.
Which is why there is this bracket with the one I'll click download so and I'll click on that.
So done.
So what we will do now is to give this certificate a name.
But it will be used for Wi-Fi.
So I'll give it CA cert CRT.
Click okay and done.
So we have now CA cert CRT is installed but not yet.
We still have to continue doing one more setup, so all I have to do is scroll all the way down and
what I have here is click onto the WiFi settings, right click onto that, click into the advanced or
it should be under edit.
So advanced options.
So right here there is a proxy part.
So I'll click onto manual and I'll enter the proxy host name.
So 192.168.0.105.
So this is where Burpsuite our interceptor is running.
So I have the port of 8085.
Click save.
So done.
We have now set that up successfully.
Now before we continue any further we need to head back over into Kali Linux.
So in Kali Linux we have to ensure that our in this case interception is turned on.
So intercept is now turned on.
I head back over into our mobile device.
So in this case we have the mobile device right here.
I go over into the target application that we have okay.
So in this situation I can enter the following length of, say, hacker lore.
All right.
And then followed by, say, the password of handsome lore.
Okay.
So I'll go ahead and click onto login.
All right.
And if I head back over into Colinux right here you can see the following.
Okay.
We have the interception.
We have username and we have the password of Handsome Boy.
And of course I can send this over into say repeater.
And we can click send on this and we'll be able to get the response.
So is it the following.
Wrong password.
All right.
Now that it is set up let's get hacking.
So go ahead and enter the username in this case hacker Lloyd.
I love you hacker Lloyd.
As the password.
I'll click login and we can see the interception right on the background.
So I'll go ahead and click onto forward and we'll see.
For example we are now logged in.
All right.
So once we're here I can say for example go over into the change password.
And we have auto filling of hacker Lloyd's the username and the password.
So password in this situation is.
If you click on to this username, we are unable to edit on it.
So perhaps it is passing a user ID or username or whichever.
But let's see what is the real request that is being sent over into the back end endpoint.
So if I enter say one, two, three, four, five, six, seven, eight and so on, okay, it's likely
not going to work because it requires some complex password as a mobile application security.
So in this situation, what I will do is I'll use a slightly more complex password to do just that.
All right.
So in this case we have a password.
So again it doesn't matter because ultimately we will be editing or intercepting it and then doing a
modification of things.
So I click change password I can see right here we have the interception which is a pose to slash change
password.
So I can send this to repeater now and think about okay if there is hacker law and there is this password.
So maybe I can bypass the mobile application security check against the password I click send on this.
And this worked.
All right.
So we were able to change the password bypassing those password complexity requirements.
Now the more important question is what if we can change the username to what if I change it to say
jack, which is another user's account.
And I give a simple password like 12345678.
I click send on this and we get a change password successful.
And with that in mind, what I can do here is I can head over into the mobile application and from the
mobile application, what I will do here right now is to exit.
All right.
The application and I'll re log in again.
So I'll go over into the insecure banking app.
I enter Jack and remember the password right.
12345678.
I click login.
We will have an interception right here.
So I'll go ahead and drop this one.
And you can see here we have the interception I click forward on this I head back to the mobile application.
Boom.
And it's game over.