Hacking trick by ethical hacker

What a great interview! Watch this video to find out how you can get hacked while using public WiFi.
Check out the full version here: • Ryan Montgomery - #1 E...
And see how we built our own WIFi Pineapple: • We explored real DIY P...
#ethicalhacking #flipperzero #shorts #sumsub
Sumsub - empowering compliance and anti-fraud teams to fight money laundering, terrorist financing, and online fraud.
More about us:
sumsub.com
/ sumsubcom
/ sumsubcom
/ admin

[@Sumsubcom]

Full interview: kzbin.info/www/bejne/p5vdkGNtYqmpe5I How we built our own WiFi Pineapple: kzbin.info/www/bejne/hYm8oop-bdpjqLc

[@fury999_]

TLS encryption left the chat

[@crescence5521]

Can someone explain how tls protect me from dns attacks?

[@bugsqli9301]

😂

[@fury999_]

@@crescence5521 To protect yourself from dns attacks you have TLS Certificate Authorities

[@beepboop-o5s]

are you implying tls an save you?

[@fmis13]

@USERNAME_CHECKS_OUTBut you won't have HTTPS, or the fake certificate is going to be flagged - both of which you should know is a no-no to type your info in

[@verumignis4778]

SSL/TLS exists for a reason. You can perform an ARP attack on a public network to sniff packets but you can't read them because they are encrypted. DNS is often not encrypted and so you can read and modify those packets, however if you were to modify them the client device would throw an error and refuse to connect to the server. TLDR: other people on a public network know what servers you are connecting to but they don't know what data is being sent between you and the server and they cannot modify the data. WiFi passwords are easy to steal by pretending to be a WiFi network known by a device, then asking that device for the password, therefore many companies use network access controls where you have to "sign in" to the network to use it. Never use a WiFi password on any other account.

[@eib2445]

wouldn't a Rogue AP work to decrypot the traffic?

[@tristfularcadia]

​@@eib2445they can capture the actual packets and try to decrypt later but that's extremely unrealistic. Additionally, you can eliminate a lot of these issues with a simple VPN, but you must trust your VPN provider or set it up yourself as a VPN provider can also capture all of the packets as well. The thing is these kind of attacks we're extremely prevalent like 15 years ago, nowadays most browsers makes you go through a lot of steps if you're not visiting encrypted websites. This just isn't that realistic anymore for public Wi-Fi. There's some Advanced Techniques that can be used to capture a lot more data but people using those kind techniques will use much more sophisticated attacks that aren't even related to public Wi-Fi hijacking. I would be much more worried about people using RFID readers on wallets and purses then people attempting to use man-in-the-middle attacks on public Wi-Fi. RFID attacks and skimmers actually happened in the real world, these kind of attacks typically don't.

[@beepboop-o5s]

you are confused. ssl, tls, and hsts are all super easy to break and manipulate. so easy script kiddies earn how to do it on youtube lol

[@beepboop-o5s]

yes. super easy@@eib2445

[@tristfularcadia]

@@beepboop-o5s they used to not be easy break, then again I haven't been in this field in a long time

[@Bananaa69]

This guy is not the #1 ethical hacker lmfao only reason people call him that was because he was ranked #1 on some site

[@ImARealHumanPerson]

'Some site' lmao

[@Bananaa69]

@@ImARealHumanPerson Yeah unfortunately I forgot which site I hope someone can remind me in the comments

[@nandeeyr]

​​@@Bananaa69t's Tryhackme, He is No.1 ranked there. But it's not site to measure Top hackers,because it's a learning platform for beginners 😅

[@ko-Daegu]

@@ImARealHumanPersonwill THM is an easy site to rank high u can get top 0.1% if you do new to hacking and let’s say have it everyday training for 6-8 months But it’s courses and solving vul boxes that’s it Not the easiest thing out their but many top hackers don’t even use it Especially people who started back then it was frustration to work with basic stuff

[@SonoSage]

"Some site" tell me you don't know what you're talking about without telling me you don't know anything about what you're talking about

[@MsWorldMine]

Except almost everything is encrypted nowadays

[@beepboop-o5s]

lol do you have a point? ssl, hsts all of it, super easy to break. so easy, script kiddies can go learn how to do it n youtube lol

[@gasun1274]

​@@beepboop-o5sif script kiddies can do it billions would have been lost each year.

[@NathanHedglin]

Yes and you have to have a handshake to set that up. MITM for the win.

[@hypertizer]

​@@beepboop-o5sbs

[@deang5622]

Irrelevant. Because if you are on the same WiFi network as your attacker, everyone gets the same encryption/decryption keys..including your attacker.

[@Amarjeet_Singh51]

You can’t get passwords of ssl websites unless you install ca certificate in the victim Browser

[@RuiFungYip]

@@davidblunt5149 HSTS. And HSTS-Preload.

[@vikramjithans6023]

Bhaji kida haal chal

[@VoAviation]

I assume this video meant phishing attacks, not just randomly stealing credentials from a device unless it has vulnerabilities to do so.

[@brbl415]

the guy talked about dns poisoning. the website where you login your credientials is his website. ssl or not he owns the backend

[@beepboop-o5s]

1. youre wrong. 2. faking certs is easy as fuck

[@myname-mz3lo]

you can show normies the most basic things and they think you are mr robot lol

[@2smg-gn7on]

TRUE

[@THEDRAGONGAMER]

Him: thinks he’s smart with his fake wifi Me: 😂 laughs with my mobile data plan

[@abu_3badi]

If the website asked you to re-login when you are contacting a public WiFi, don't put it and recheck the link again

[@StiekemeHenk]

TLS + DNS over HTTPS + Mullvad VPN moment

[@markp8295]

Thank you for making all those hand shakes over the compromised network. Of course when you connect to the VPN IP, its definitely the VPN hosting it... Complicated? Yep. Likely. Much less. Still not perfectly safe.

[@StiekemeHenk]

@@markp8295 yeah, so... It is my VPN because of my DNS over HTTPS/TLS. Otherwise, the connection fails. It's a direct mitigation against this.

[@luk1505]

​@@StiekemeHenk You are right for the most part, although in some cases you could still be compromised by TLS decryption and deep packet inspection. As a rule of thumb, compromised network is... compromised. You can mitigate against MIM, but won't be totally safe. Security is a cat and mouse game. All those hacking KZbin videos are oversimplified and usually showcase just the easiest, dumbest scenario. In reality, it's rarely that simple.

[@CZghost]

@@luk1505 I generally try to avoid public Wi-Fi networks as much as I can, always use my cellular data service whereever possible. That's not however always possible. One possible scenario is running out of data plan, which can happen in my case. Won't happen for unlimited data plans. Another, much likely scenario is coming to a place where there is very sparse cellphone service, and where it wouldn't be possible to connect to the internet using cellular data service. I came across one such place, there was no cellphone service, I wouldn't even be able to call an ambulance from my cellphone if something was to happen, anyone else in vicinity would face the same issue. Landline is a savior in that place for this purpose. I would even argue that this would be one of the few places where payphones would still make sense nowadays. But there is a restaurant for tourists, which has a public Wi-Fi for guests. And there's even a way to pay with your phone, but you have to be connected to that public Wi-Fi if you want so, which is a bit concerning. So why not cellular data? Well, there ain't any. Wi-Fi is the only way you can browse. You don't have to pay with your phone tho. As long as you have cash or a credit card with you to pay, you can always call the service to pay. Luckily.

[@ko-Daegu]

@@luk1505now how would u decrypt the TLs I’m waiting ???

[@FielValeryRTS]

I've attended a course on web security a few years ago. The speaker did the same thing and caught a few students with it. That changed my mind quite abruptly. I'm not using public WiFi ever again. 😂 Also never selling my phone or ssd/hdd ever... There's always a chance for anyone to retrieve sensitive information.

[@thegeek7680]

This video promotes BYOW (bring your own wifi)

[@MygenteTV]

i see you know your thing

[@samhilton4173]

System of a Download

[@teeterthepop]

Love my hackers looking slightly malnourished

[@bugrakadirhan7888]

DNSSEC has left the chat

[@nino7028]

I am an ethical thief. I even steal everything politely.

[@antichrist_revealed]

Public Wi Fi is easy to see and usually has a password they provide for you. You never have to use your own.

[@DisGuclerOfficial]

Me with 14 Rooters and 4 TOR's: your ESP will cry for help

[@bugsqli9301]

😮

[@michaelproust7891]

Could you explain how dangerous ?What's App is in terms that for the layman?

[@lucianolucky7853]

I thought it was some kind of ARP attack he was talking about here. DNS? Come on, most of browsers pop up a big warning window if the ssl certificate is not right, tough luck to hack google’s private key and fake your own certificate

[@sporehux8344]

His target demographic are imaginary people from 2001

[@beepboop-o5s]

you act like a 12 year old cant learn to ssl strip on youtube in 15 minutes.

Mobile service providers laughing their arses off😂

[@tjmns]

Yes always disable the auto connect to networks option

[@LordMarcus]

MitM needs more than a compromised AP to work, yeah? They have to serve up a bogus SSL cert if they want to capture your passwords, cookies, etc.? Unless you're sending passwords as cleartext to your bank or w/e.

[@LordMarcus]

@@IgorPodgorny-o5l Oh yeah, I didn't even think about doing that. And the attacker could easily get a free SSL cert so their bogus page has a valid secure 🔒 or ✅ on it regardless.

[@tristfularcadia]

​@@IgorPodgorny-o5lthat used to work back in the day, but the majority of browsers nowadays put huge warnings on unsecured websites. And even more of a headache if the certifications don't match. These kind of attacks just don't happen much anymore, and realistically are even worth worrying about. Just use a trusted VPN provider, or set one up yourself. If it doesn't connect on a Wi-Fi network get the hell off that Wi-Fi network

[@beepboop-o5s]

serving up a fake ssl is simpler than making microwave food

[@mdel-nightmare9891]

#1 ethical hacker 😂😂😂😂 From where you getting this confidence 😂

[@vikramjithans6023]

security is an illusion 🕵

[@annoyinggasta]

Always has been, some people literally open padlocks by smashing them

[@ankokunokayoubi]

No system is safe

[@Carlito84Qc]

​@@annoyinggastalots of padlock opens that way 😂

[@shrekupine4445]

​@@ankokunokayoubiChina will grow larger

[@FlorianWendelborn]

But not because of this. HSTS is enough to protect you in this case.

[@sea_castic]

Sir please tell us all an organised plan or roadmap to learn ethical hacking Cause everyone says that yt is enough for learning anything but it is not If we to learn free how can we ??

[@fabiandrinksmilk6205]

NetworkChuck and David Bombal have great channels. I believe they also have a video on the certifications you should get to get hired and what you should learn for them.

[@MygenteTV]

this is not something you learn but you learn about. cybersecurity is something very, very big. you yeah you can start with eJPT certification

[@cateatfood6634]

I'm sorry, but who connects to a random wifi? Do people not have mobile data?

[@ahmadnasir8892]

Its simple.. just use vpn in public network.. dont be paranoid.

[@beepboop-o5s]

wrong

[@olliflying]

@@beepboop-o5s please elaborate instead of just saying "wrong". your comment helps no one

[@MrSamdizzy]

@@beepboop-o5ssplain yuself

[@rizonware]

I just use public WiFi to watch corn hub

[@OttoBarabas]

Would a VPN help while connected to public network ?

[@ImARealHumanPerson]

Would using DoH stop a man in the middle? Or DNScrypt?

[@ko-Daegu]

Yupe but if there’s away to strip the cert you are using with deep packet inspection then u are screwed avoid public networks is the best tjing

[@ImARealHumanPerson]

​@@ko-DaeguThank you for the answer. I don't use public. I was just curious.

[@FlorianWendelborn]

HSTS stops this

[@mywifeishot1986]

​@Harisfd1😂

[@michman2]

When traveling, use 4G or 5G. The internet is like a playground in the slimy part of town.

[@tigerlion7753]

Just do my research. So basically this guy, who is a hacker is actually someone who exposes child predator and works to protect children, which is good

[@Ayaanlemedia]

I will never use public wifi again 😂😂😂

[@elir.torres8642]

This works if you are not using TLS,SSL, or HTTPS or iPSeC or VPN protocol.

[@Geikith]

VPN isn't a protocol and doesn't necessarily implement encryption.

[@elir.torres8642]

@@Geikith So, if a VPN service doesn't use a encryption protocol then that must mean it does not use encryption therefore there is no secure tunnel between two points. So, you need to explain what your version of a VPN is because in 12 years of IT knowledge, degrees, and experience, I have never seen or heard of a VPN product you are describing. Is this your own proprietary VPN service you engineered? If so, where the GIT repo? Please back up your argument. Note: it's been 13 hours and you haven't answered my comments. See people like you talk out of your arse, are uneducated, are hood, ya really need to get an education period instead of wasting my our time on here.

[@tjmns]

​@@elir.torres8642nord vpn would tunnel right on through protecting valuable data. GL cracking strong passwords

[@gownerjones]

Why would this professional hacker use a hobbyist gimmick like the flipper zero instead of professional tools? The thing he has in his hand surely is no flipper zero.

[@soccerguy2433]

If this was a real prevalent threat all public wifi would not veuaed due to the threat

[@barackobama386]

just use VPN

[@war32mec]

So does vpn services actuality work or do the hacks have a way around that ??

[@beepboop-o5s]

vpn does nothing to stop someone who wants your dta

[@stevemcqueen1904]

This man just hacked my search history

[@imaok4721]

Did you right the code ?

[@bondjames652]

You can steal my identity but you won't like the perks.

[@redonk1740]

lmao this has been a thing WAY WAY before the flipper zero came out. Cain & Abel.... anyone?

[@thebosscrystal]

I don’t remember when but at one point I was like bruh this guy just saying clickbait words to mainly talk about something simple

[@beepboop-o5s]

in fairness, ryan has so much social anxiety he can barely talk in this interview.

[@CZghost]

It's told to connect to a VPN if you use public Wi-Fi. The thing with VPN service provider is that it actually picks a specific IP address from their pool of IP addresses available on the picked location, so it's very robust against this DNS attack.

[@z08840]

proper connections are already secured with TLS

[@beepboop-o5s]

youre so boring. another wannabe that gets his jollies by pretending to know something. tls is so easily manipulated there are tutorials a twelve year old can follow on youtube. same goes for ssl, and hsts. stop being a hater to fuel your self esteem, and put your time into learning@@z08840

[@mygeezu]

good thing unlimited mobile data plans are so affordable in my country that I don't really ever need to use public or any wifi networks for that matter.

[@Skubidi-qy8hb]

Best websites for me to start my hacker career?

[@silenthillfan01234]

I don’t get why people are so desperate for free wifi. Pay the extra 20 a month get enough data to literally never worry

[@jackwaycombe]

Never have used public wifi. Never would. Nor public charging cables.

[@rasmuspersson1000]

Can we all just take a second and realizes that this is the most basic thing Kali can do. I did it drunk, with no knowledge and 7 min of KZbin

[@BigChanThaPlug]

pineapple/kali/flipper all amazing tools

[@Crown42]

Lol, this is simple stuff that anyone can learn on KZbin or an online course.

[@tntxqx8281]

SSL in background: 👀

[@TrackinDaMeta]

Broadly it is MITM but more specifically it is an evil twin

[@DJIInLondon]

SSL strip left the chat in 2008

[@chazlabreck]

what are these people selling?

[@grandmaster8213]

He’s definitely not the number one ethical hacker

[@kwatkins7272]

Raspberry Pies are also a hackers best friend.

[@goodluckbutters]

If everyone knows you're the best hacker, you're not the best hacker.

[@specialk5070]

When I’m hacking other computers I always us pubic wi-fi 😂💨💨💨💨💨

[@Boxersteavee]

This has been obselete since the dawn of HTTPS... 23 years ago

[@darvinde]

Dns spoofing not.

[@Vegan123]

Great - but the likelyhood of this happening is low

[@KJ-xt3yu]

"as soon as you connect to those...." said every hacker that knows (auto reconnect) is the default save. p.s. you can make any wifi broadcast name and make fakes that are the only choice to connect to.

[@NOSCAM]

Future belongs to the nerds

[@thatguysomewhere]

Everybody who knows the Rogan podcast, has already seen this, and don't need your second opinion

[@beepboop-o5s]

rogan?? lmfao

[@smokeythabear1518]

Why my cyber security firm tells you to never use public networks or anyone elses you cant admin for..

[@kasualraps]

VPN entered the chat

[@istvanr.6093]

This was working before everything went to SSL. I mean TLS. Who the heck uses unencrypted connection nowadays?

[@gamerawesome4409]

What Randy Orton doing?

[@barnabuskorrum4004]

Quick. Stay home and never do anything!!!

[@Peace4Us909]

This is same guy who discovered and exposed sex trafficking, he told the FBI and they pretty much ignored him 😡😡

[@BassandClap]

Nice frightening story for the media but there are still things you can't fake with DNS spoofing and that's certificates. If you setup a fake website that e.g. looks like Instagram, you will immediately see an error message in your browser saying that there is no trusted certificate in place, that's a red flag for public known sites

[@eib2445]

so he generated a bunch of fake SSIDs, thats cool and all but those little deauth watches can do the same thing.

[@chilipep4438]

Public Wi-Fi is officially as dirty as public restrooms

[@shmulyzuriel8717]

Fun fact, your phone is probably dirtier than a public toilet stall.

[@BrandonsOnline]

I mean if you’re using HTTPS you’re fine lol

[@KairavRaju-kc1mc]

who else is handsom asf but still like hacking

[@koolerpure]

Perhaps it used to work this way but it no other is possible

[@MT-xs4fu]

I love uploading malware by commenting on YT.

[@eazysnatch]

Its actually called DNS spoofing. DNS attack is attacking the DNS server not the client ( user )

[@beepboop-o5s]

in fairness, ryan is insanely bad at communication and is so socilly awakward he can barely have this convo.

[@Mellik47]

Imagina if Ryan was not on our side 💀💀 better thank him

[@Megamanthemachine]

Damn I am about to start learning to use a secure dns before he reroutes my connection but what he got wrong is that you need to enter those passwords of course if he has deep malware or knows vulnerabilities within the browser he could try to retrieve it from within your browsers cached data which is not encrypted that’s risk

[@MelodyMan69]

Then you are a CRIMINAL and should be treated as one. Stealing is stealing is stealing...

[@24x7locks5]

Get a pineapple and collect to your heart's content.

[@savewayadmin2085]

What app do you download to get out of the acid in a drum.!!.

[@Mr.Kumar1]

How can you just get someones credentials or password just by being on his network..?

[@Praptoprapti2023]

Private DNS help?

[@LootShrimp]

Tell them about the card scanners in check out lanes, people will only want to use cash after you do.

[@Enerzon]

Yeh I watched that podcast. That's really amazing.

[@OneManCanStopTheMotorOfWorld]

The dude is an absolute fraud lmfao. We don't use toys, we use out mf laptops.

[@kriscahya]

Me looking for free WiFi......

[@vikramkumarp]

You will collecting our passwords and meanwhile do you think chrome will be simple watching.. it's nearly impossible to generate fake bank website and collect password.. 😂😂

[@koruspring1519]

I’ll join that network and login my bank account. I’d love to see how you plan to defeat HTTPS. I won’t click proceed if browser warns me of untrusted certs or anything.

[@adrian23422]

Good luck cracking the hash of whatever data you intercepted...

[@moslimislam5714]

DNS with flipper zero??

[@Boxersteavee]

I'm sure he used a flipper zero devboard in a clip shot in 480p

[@BossModeGod]

I’m currently dealing with this issue. My home WiFi’s been hacked Hi weirdo😃🤚

[@maninderjitsingh4919]

Thats why i have 100 gigs of mob data

[@niallkarger1057]

And your service provider does this anyway wake up ppl

[@Phantom8589]

This is why I never use Wifi!

[@bobbyhillthe3rd]

This is way to much for me to understand haha

[@Ur.cristianoronaldo-7-u9t]

✋I use public network and I don't have fear of hacker coz hacker can't Steel anything because I am poor 😂

[@powerdust015lastname4]

they can still steal your data. sometimes that can be worth even more that *your* money. just one example is that the hacker wants to access the computers of the company you work for, getting their hands the company’s money or data by using *your* credentials

[@TheJoshShephard]

Just because you are poor doesn't mean someone wouldn't wanna hurt you or those you love. Think of it like this. Though you are poor and have nothing maybe worth stealing, that you're aware of. It's like choosing to leave your doors unlocked because you don't own anything seemingly desirable. While ignoring the fact that someone with iller intent may wanna victimize you and anyone who lives with you. Being mindful of your privacy and security also helps keep those you love and those you work for safe as well. If your device gets infected, it can be used to attack and/or infect friends, family, strangers, and companies. If you don't consider your information valuable or important. At least consider how your loved ones information could be valuable to a thief, stalker, bully or worse. Even if you don't get infected, if enough data is leaked it can potentially be used in a social engineering attack against loved ones or the company you work for

[@MrKylew1990]

If you join a public wifi network you do not know your probably a boomer 😂 Use your 5g data pplz..

[@iblocstudios5563]

theres a new falseAP exploit where it jams the original wifi and makes a new falseAP secured with a password when someone fills in this password it gets checked with the real wifi if it checks out the falseAP basically got the password and full acces to their network launching an automated attack on all devices on that network while the user is still being monitored for packets with payment details or login details ect