+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Wifi 5G WPA WEP Bluetooth Wireless Hacking (https://hackforums.net/forumdisplay.php?fid=104)
+---- Thread: SSL strip not working on sites like facebook, twitter etc. (/showthread.php?tid=5425726)
SSL strip not working on sites like facebook, twitter etc. - shvm0396 - Oct 6, 2016
Hi there, I am trying to execute MITM attack using SSL strip.. But its not working on sites like facebook,twitter, gmail.. Is there any fix or substitute to sniff passwords from these sites over a WIFI network..
I am using Kali Linux OS and arpspoof and sslstrip for this attack. please help.
* - pomwtin - Oct 6, 2016
Ye, those sites are using HSTS. You can bypass this by using sslstripv2+dns2proxy if target is navigating to webpage by browser, or cacheraser if target is navigating to webpage via url.
Also, give it 30 min and lookup what this HSTS is... it will be more clearer what I am speaking of then, how it works and how to get past it
* - shvm0396 - Oct 6, 2016
okay .. thanks for help.. I will check this out .. I was surprised to see that most banking sites do not use HSTS .. they can be stripped simply through sslstrip..
Have you tried bettercap to bypass HSTS ?
* - pomwtin - Oct 7, 2016
(Oct 6, 2016 11:21 PM)shvm0396 Wrote: okay .. thanks for help.. I will check this out .. I was surprised to see that most banking sites do not use HSTS .. they can be stripped simply through sslstrip..
Have you tried bettercap to bypass HSTS ?
Usually bank sites forces ssl or do not work at all without encryption, at least this is what I noticed till now... Of course it will depend from bank to bank, but it would be a bit foolish not to force https...
I believe bettercap uses method with sslstrip v2+ dns2proxy
* - shvm0396 - Oct 12, 2016
okay i'm gonna try bettercap then.. and will let you know the results.
* - bo0m - Oct 13, 2016
try mimf framework
* - Reptile-Ermac - Oct 13, 2016
(Oct 12, 2016 10:09 PM)shvm0396 Wrote: okay i'm gonna try bettercap then.. and will let you know the results.
its ettercap mate ! there are many apps to do that . Use zAnti or SSLStrip to strip https to http.Then use packate capture to finish the rest of the work bro ✌
* - pomwtin - Oct 13, 2016
(Oct 13, 2016 03:12 AM)Reptile-Ermac Wrote: its ettercap mate
No, bettercap is in generall better
* - azag - Oct 14, 2016
it'll not work unless you make the phone , pc or whatever accept your certificate .. or just dns spoof the targeted websites you wanna sniff