Another MITM automation

[comaX]

Hi everyone ! I did this automating script so I don't have to retype all the commands every time I want to do a mitm attack. I know there are a lot of scripts out there for sslstrip and stuff, so if you mods feel like deleting the post, please do.

This is my first script, so it should be easily understood by anyone, and should help learning basic bash scripting along with facilitating the use of the MITM attack.

Of course this should only be used on your network and for learning purpose only.

I would also like to thank killadaninja for his script "airssl" that taught me a lot and allowed me to do this one. His is for Rogue AP use, whether this one is for local use.

Please criticize it, and help me improve it.

Code was out dated and I couldn't update it here; dunno why. Check my website below or the pastebin ! 
I made heavy updates since first post, check them !
Features : network mapping, multiple targets support, display sniffed passwords user friendly, parameters for help and update.

You can download it here : comax.pagesperso-orange.fr/mitm.sh or go there : http://comax.pagesperso-orange.fr/#ixzz1DvVhGYMt and check text code, pastebin code, and demonstration video !

Changelog in version 0.6.7 (last version to date, probably the last one.):
- Very neat and kewl ascii
- Log parsing, finally ! Must be tested on a maximum of different configuration to ensure accuracy.

[cnmlf]

Hello comaX ,

First of all thanks for sharing
never be afraid to put scripts online even if there is like 1000000 scripts like it
it doesn't mean yours is not as good as the others or even better ...

so you just go like : sh "script.sh"

and at the end of the session (when you evoke 'quit') the passwords will be shown on the terminal ?
am i correct ?

you should think about storing usernames and passwords in a seperate file like :
website :
username :
password :

website :
username :
password :

...

which will make it clearer ...

good luck with the script buddy

[acez0]

Hey man, I think it's a pretty decent script but you should let the user pick the interface he wants to use.

[comaX]

Hello comaX ,

First of all thanks for sharing
never be afraid to put scripts online even if there is like 1000000 scripts like it
it doesn't mean yours is not as good as the others or even better ...

so you just go like : sh "script.sh"

and at the end of the session (when you evoke 'quit') the passwords will be shown on the terminal ?
am i correct ?

you should think about storing usernames and passwords in a seperate file like :
website :
username :
password :

website :
username :
password :

...

which will make it clearer ...

good luck with the script buddy

You are right, it does show up passwords. Your idea is very good but I don't know how to do it at all... If you have any suggestion, I will try !
Currently it's only "cat logfile | grep string", string being password= etc.

Hey man, I think it's a pretty decent script but you should let the user pick the interface he wants to use.

That's absolutely right and I didn't think about that. I will add it as soon as I get home.

EDIT : added.

Thanks for the feedback guys, keep it coming !

[ugothakd]

When it asked "Would you like to target a single target or the whole network ?" and requested for Y or N, and I choose y (lowercase) it quit on me. Just a suggestion make it that more user friendly.

[mango_leech]

Nice work !!
For storing username : password on another file......just redirect the ouptut to another file where you grep the log file for password.

Or you can just use pipe it to "tee <filename>" to show it on standard output as well as store it on a file.

[comaX]

I'm having big troubles for posting (a message from another (temp) account of mine will probably show up next). Sorry for inconvenience !
Script is updated on the link in my first post.
I'm looking forward hearing your feedback again !

EDIT : I made a pastebin, go check it out, it's all updated and heavily commented! (see my first post)

[comaX13]

Hi guys, my account is very buggy, I can't post or edit my posts, so I am using a temporary one. The link to the script on my website is being updated every time I find something new. I'll try and keep you posted. Since I can't post my code (that is what seems to make the forum go crazy about my account and IP), if one of you could try and post the new version, that would be nice !

Also, thanks for the feed back, I appreciate it !

[comaX]

Well it seems like I now can post again, anything but the code... I updated my first post so check it out ; I made a lot of changes since last post. Sorry for bumping the thread like that, but I didn't really have a choice !

[voidnecron]

Your site/hoster is four oh four. Please update the URL.