Man in the middle attack against Windows Xp SP3 with Backtrack 4 R1 - problem

[sickness]

hakermania, use ettercap with sslstrip )

[hakermania]

I'll try this out and I'll let you know!

[hakermania]

I did a lot of tries to capture passwds with ssl encryption but I was unlucky!!!
When I was trying to do this, neither normal passwds nor ssl encrypted were captured!!!
..

[sickness]

Which guide are you following ?

[Mr-Protocol]

From my understanding you are wondering why until you start SSL Strip the users have no access to the web/ssl sites.

The reason is you are forwarding ports to a service that isn't running.

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

With that you are taking port 80 traffic and redirecting to port 8080. Great but nothing is listening on port 8080.

When you start sslstrip you have it listen for port 8080 and sslstrip forwards on the packets to the world.

[Snayler]

Great but nothing is listening on port 8080.

Wrong...

sslstrip -l 8080

SSLStrip is listening on port 8080.

[Mr-Protocol]

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
arpspoof -i eth0 -t 192.168.1.4 192.168.1.1 [here network at victim is disabled]
(in new terminal) sslstrip -l 8080 [here is enabled again]

Wrong...

sslstrip -l 8080

SSLStrip is listening on port 8080.

SSL Strip was not running when the victim lost internet. When the OP ran SSLStrip after the forwarding and arpspoof, internet access to the "test station/vic" was working.

[Snayler]

Unfortunately, when I tried to do this against a machine running win xp sp3, the network was gone even when I gave sslstrip -l 8080.

SSL Strip was not running when the victim lost internet. When the OP ran SSLStrip after the forwarding and arpspoof, internet access to the "test station/vic" was working.

That was in Ubuntu case, OP's problem is with Windows not having internet access even after running sslstrip.

[Mr-Protocol]

Not sure but it should work the same.

I've done MITM with XP SP3 in my lab for a presentation in my Networking Forensics course.

Something with the initial setup must be wrong. Or he needs to clear the ARP cache on his router and Machines.

[Snayler]

hakermania, an important question: Have you uncommented the iptables part in etter.conf?

Also, try using ettercap arp poisoning capabilities instead of arpspoof, because it's odd that you don't have connectivity after running arpspoof.