dd-wrt redirecting traffic to a sslstrip box

[Ubscene]

I was thinking of a project with a dd-wrt router configured with iptables sending (prerouted) packets to a local server which has sslstrip running, would it be possible to setup? Which would be the iptables rule to append?

A simple diagram:

Client_request -> Router -> SSLstrip_server
SSLstrip_server_reply -> Router -> Client

Ubscene

[Carto_]

It interest me, my knowledge is too bad to help you but if someone have an idea, it will be great !

[lulzapram]

I am sure that it could be done. I might try this in sometime this week if I get a chance and post my rules here.

In the mean time, here's my follow-up question: could you do it without the additional local (I am reading physical here, so correct me if I am wrong) server? I know that people have managed to run python-based servers on their DD-WRT'ed routers in the past. This could be an interesting project.

-lulz

[Carto_]

All on the router, without the need of any redirection to a local computer ? I never hear anything about this kind of attak. It would be great, i agree, but is it possible ?

I'll search about it and if i find some things i'll post it here.

[thaijames]

All on the router, without the need of any redirection to a local computer ? I never hear anything about this kind of attak. It would be great, i agree, but is it possible ?

I'll search about it and if i find some things i'll post it here.

I think the key is to use one of the newer routers with enough ram and maybe additional disk space through USB or MMC.

Would be great!

[bl0tch]

any progress here?

[Carto_]

It's possible to give to the WRT54G additional disk space with this hack :


SD Card


Fortunately, the integrated processor offers a number of General Purpose Input/Output (GPIO) con- nectors that you can leverage to interface with a standard Secure Digital (SD) card. As a result, you can provide some additional storage to the WRT54G, in addition to the standard flash, usable as system disk.

Components Needed for This Hack
This hack requires a few additional components that are not provided standard with any WRT54G model.

SOURCE : http://clochard.org/~fnord/CadeauBonux.pdf (PAGE 276)


I'will try this hack and after that, we'll find a way to use sslstrip inside.

Any news about this hack ? I'will try the hack in few days but i'd like to know if someone find a way to install and run sslstrip on a router flashed with OpenWRT or DD-WRT ?

I continue my research .

[thaijames]

I have a couple DD-WRT already setup with SD card and USB if someone has some python code to try out. One of them with 128MB RAM and 4 Gig USB
Wont get back to the office for a couple of weeks, but I can try compiling SSL strip and dependencies

It's possible t o give to the WRT54G additional disk space with this hack :


SD Card


Fortunately, the integrated processor offers a number of General Purpose Input/Output (GPIO) con- nectors that you can leverage to interface with a standard Secure Digital (SD) card. As a result, you can provide some additional storage to the WRT54G, in addition to the standard flash, usable as system disk.

Components Needed for This Hack
This hack requires a few additional components that are not provided standard with any WRT54G model.

SOURCE : http://clochard.org/~fnord/CadeauBonux.pdf (PAGE 276)


I'will try this hack and after that, we'll find a way to use sslstrip inside.

Any news about this hack ? I'will try the hack in few days but i'd like to know if someone find a way to install and run sslstrip on a router flashed with OpenWRT or DD-WRT ?

I continue my research .

[Carto_]

I don't have any python code here yet but i'll give you that soon.

For the SD hack, it's ok for my part but a question persist :

How do you add more RAM and usb as extra storage ?
(WRT54G?)

[bl0tch]

any of you figured out the prerouted forwarding part for the dd-wrt? i thought i had it with http redirect in the hotspot tab but havent gotten it to work it may be meant for just within the network while im trying to send all packets over the net to a proxy. i cant imagine it should be so hard to figure out how to forward everything outside the lan to a proxy but after weeks i still cant get it working no matter what i try.