Skip to content

Latest commit

 

History

History
132 lines (87 loc) · 4.14 KB

googlehack.md

File metadata and controls

132 lines (87 loc) · 4.14 KB

In this demo you will

  • Start locally HAM server
  • Connect to it through proxy
  • Intercept Google calls and replace the logo!

For more info look here!

Download the last release

Download the tar.gz, ham only from github releases and extract it

Starting the sample application

Go on the "ham" directory and run "proxy.run.bat/sh"

This will start ham with all services

Install SSL root certificate

Download the certificate

Open the zip file and install as "Root certificate authority"

  • Firefox:
    • Go on Settings and search for certificates
    • Then "View certificates" and "Import"
    • Check "Trust to identify websites"
  • Chrome:
    • Go on Settings and search for certificates
    • Open the "Security" and "Manage certificates" then "Import"
    • "Place all certificates in the following store" then "Browse"
    • Select the "Trusted Root Certification Authorities"

Configure proxy

Should set the proxy to 127.0.0.1 And port 1080 for socks5 or 1081 for http/https

Click me for more explanations

  • Chrome:

    • Install Proxy Switch Omega
    • Go to options
    • Add http and https proxy server with

      • Address: 127.0.0.1

      • Port 1081.

        Ham Proxyes
    • Select "proxy" from the extension menu and back to "direct" when you want to disconnect
    • Ham Proxyes

  • Firefox

    • Navigate to about:preferences

    • Search for "proxy"

    • Click on "Settings"

    • Go to "Manual proxy Configuration"

    • Select the socks5 proxy

      • Address: 127.0.0.1
      • Port 1080

    • Check the "Proxy DNS when using SOCKS v5" flag

    • Clean the settings when needed

      Ham Proxyes

Intercept Google!

Go on the certificates configuration page and add a new website with value www.google.com

Add a new dns mapping on the dns configuration with

Restart the browser to be sure that all DNS caches are cleaned!

Go on https://www.google.com

When you click on the locker near the address you will see that the website certificate is generated through "CN=root-cert"... OUR AUTHORITY :)

On Firefox

Or on Android Chrome

Bing-ify google!

Go on the js-filters plugin and create a "Google" filter.

  • Phase: POST_CALL (change the content received)
  • Host Address: www.google.com
  • Path Address: /
  • Script. Notice the "" added to the response text, this is just to force a cast from Java String to Javscript string
var regex=/\/images\/branding\/[_a-zA-Z0-9]+\/[_a-zA-Z0-9]+\/[_a-zA-Z0-9]+\.png/gm;
var responseText = response.getResponseText()+"";
var changedText = responseText.replace(regex,'https://upload.wikimedia.org/wikipedia/commons/thumb/c/c7/Bing_logo_%282016%29.svg/320px-Bing_logo_%282016%29.svg.png');
response.setResponseText(changedText);
return false;

Navigate to https://www.google.com with BING! logo :D

On Firefox

On Android