In this lesson, we're going to see how to hijack a password that someone is stored in their browser
and see how to reveal that password in plain text.
So let's switch over to Firefox or to Chrome.
Any desktop browser, Firefox and Chrome are great for this because they allow us to use the inspect
element or inspect option when we right.
Click or control click on an element on the screen.
So I've got a few log in pages here and unfortunately most of us do this at some point.
We have the Web page.
Remember our password, you get that handy little pop up after you log in.
It says, Would you like Firefox or would you like Chrome to remember this password?
And it is handy not to have to enter a password every time.
Unfortunately, if you ever do this on a machine that has public access, like a machine, a computer
at a library, a computer at a an Internet cafe, a computer at work or at school, you can leave your
password susceptible to this kind of hijacking.
We're going to see how to reveal passwords in both Firefox and Chrome.
But you can do this in any browser.
There are tools that will let you do this in any browser.
But we're going to use just the browser itself to display those hijacked passwords.
This doesn't take very much experience, very much ability, very many skills at all.
So you can see why it's so important not to store your passwords in computers where you don't have complete
control over the machine.
And remember, you almost never have complete control of your machine.
If you walk away from your computer at Starbucks and leave it on the desktop, on the table there,
someone can walk up and do this attack just as easily as we're about to show it.
So always protect the physical access.
We're all the way back to lesson to section one.
Physical access is total access.
If somebody has access to your workstation at work, at home, school, they have access to your passwords.
If you store them in your browser, it doesn't mean you can never use this feature.
But you just need to be aware that any password you do choose to store in the browser is susceptible
to this kind of hijacking attempt.
So I have a few websites up here.
Facebook is a good first one to start since we've used it for the phishing email example.
Our user, Fred Flintstone, has entered his username and password and he's told the browser to remember
that password.
Well, all we have to do on either Chrome or newer installations of Firefox, we don't even have to
have any special tools installed to make this attack work.
We just.
Right.
Click on the password field itself or control click if we're on a Mac computer and come down to the
inspect option and notice we are on the real Facebook page.
This is secure.
My password is stored in my browser though, and I've just typed it in from the keyboard.
So if I come down to inspect and scroll over so I can see that password fields still on the screen,
the inspect feature lets you look at the HTML behind a Web page.
So this is what makes this field look like it does.
It's an input field that's from a web form.
I'll make this a little bigger in here.
There we go.
I've zoomed in just a little bit so we can see this clearer.
But this is an input field and we can see the type is password.
What's actually this little piece that makes this mask those characters?
Because we know we just typed in regular characters.
They just come up as dots or stars when we're on a Web page, changing this type from password to something
else.
And I can do this with just a double click, like a regular TextField to X and then hitting tab.
Do you see what just happened to my password?
Mean, zoom in a little more there.
You mean just by changing one little thing and the HTML behind this page, I made my.
Password, clear text.
So let's see that one more time, I'm going to click back over here for the time and I'll control Zuckermann
Z or I can just type password back tab notice it goes back to a password field.
But if I double click on type and change that to anything, I can make it text.
I can just make it.
I can add one character.
I can say pass word one and hit tab or enter.
And notice that password is no longer hidden on the Web page, the same thing for Twitter.
Right.
Click, go to inspect, find the input.
And when you click over here on the Element, you'll see that it highlights over here.
Find the type equals password.
Change that for anything else and hit tab.
And your password is plain text banking.
Click on Inspect.
Change the type equals password to anything else.
And your banking password.
Let's talk about how it works when you've got these two separate screens.
We mentioned back in phishing that phishing attempts work best when you got the username and the password
together, like we do on most sites.
But a lot of sites split this up.
And there's a good reason for this.
If I say Fred Flintstone and then I, I have my password entered in here and I walk away or I have it
autofill, I just right click come to inspect, even though it's on two separate screens, if you remember
that password.
We just have to find.
The type equals password, change it, Hattab.
And there's the password for Fred Flintstone dotcom, same thing for Gmail, even though it has two
separate screens.
If I come here and inspect, you see type equals password, make it something else.
Hit tab.
There's Fred Flintstone's password.
It's not just for Chrome either.
We can minimize this.
I've got a couple of pages loaded up here and Firefox in older versions of Firefox.
We would have to do firebug installation, we'd have to add an extension.
But these days we just come to the page where someone's stored their password.
We right click come down to inspect element.
Find that type equals password and change password to anything else, notice it's plain text right now,
but as soon as I type one extra character and password in tab.
I see Fred's password, the same thing with Twitter, right, click or command, click, inspect element,
find where it says password change.
That type equals password to anything else tab and your passwords have been hijacked.
So be very careful if you ever have your browser.
Remember passwords.
Just know that if anyone has access to that computer, they have complete access to your passwords.
This is really important stuff.
If you have a shared computer or if you use public computers in any way, you can do this on your own
personal computer for the passwords that are not most critical to you.
But even then, you leave that laptop, you leave your desktop unattended, you could be open to browser
highjacking like this, in this case, password highjacking from our browser, changing one character
by going to inspect element and changing that character, changing the type of a password field to anything
other than the password.
We reveal the entire password in plain text.
OK, this has been a useful introduction.
Don't store those passwords any place that you don't have complete control over and remember, you don't
have complete control over very much.
We'll see in the next lesson.