+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Wifi 5G WPA WEP Bluetooth Wireless Hacking (https://hackforums.net/forumdisplay.php?fid=104)
+---- Thread: Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website (/showthread.php?tid=5974498)
Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website - Godofdeathftw - May 28, 2019
I've spent the day using some different tools (MITMf, Ettercap and dnsspoof) to DNS Spoof websites such as Facebook, Gmail, etc. Grabbing the entered credentials on a duplicate website works totally fine when I just make up my own random website domain, but when I try to redirect the official facebook to my unofficial domain, I always get the error "Your connection is not private", and the webpage never loads. I hoped that this could be fixed by using an SSL Strip (--hsts using MITMf), but that didn't change anything.
(python mitmf.py -i eth0 --spoof --arp --dns --target 192.xxx.xx.xxx --gateway 192.xxx.xx.x --hsts)
Are newer browsers totally protected from any kind of SSL Strip that would work for DNS Spoofing?
Is there any way that I can spoof a official domain such as Facebook or Gmail? If not, are there any other methods you can recommend I look into for stealing data on a local network?
P.S. I'm doing this just for fun, to give my brother a scare, because it's cool, and to maybe become a White Hat Hacker in the future.
RE: Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website - Mad76e. - May 29, 2019
(May 28, 2019 01:29 PM)Godofdeathftw Wrote: I've spent the day using some different tools (MITMf, Ettercap and dnsspoof) to DNS Spoof websites such as Facebook, Gmail, etc. Grabbing the entered credentials on a duplicate website works totally fine when I just make up my own random website domain, but when I try to redirect the official facebook to my unofficial domain, I always get the error "Your connection is not private", and the webpage never loads. I hoped that this could be fixed by using an SSL Strip (--hsts using MITMf), but that didn't change anything.
(python mitmf.py -i eth0 --spoof --arp --dns --target 192.xxx.xx.xxx --gateway 192.xxx.xx.x --hsts)
Are newer browsers totally protected from any kind of SSL Strip that would work for DNS Spoofing?
Is there any way that I can spoof a official domain such as Facebook or Gmail? If not, are there any other methods you can recommend I look into for stealing data on a local network?
P.S. I'm doing this just for fun, to give my brother a scare, because it's cool, and to maybe become a White Hat Hacker in the future.
Hmm.. I do believe this falls under another subforum, i will try to move it for you
RE: Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website - Godofdeathftw - May 30, 2019
(May 29, 2019 03:04 PM)YadaYadaVad Wrote: Hmm.. I do believe this falls under another subforum, i will try to move it for you
OH, good to know. Which subform would you recommend I post it under?
RE: Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website - Mad76e. - May 30, 2019
(May 30, 2019 12:15 PM)Godofdeathftw Wrote: OH, good to know. Which subform would you recommend I post it under?
I asked it to be moved to Beginner hacking Subforum, you dont need to do anything, it will be moved there eventually
RE: Is it still possible to SSL Strip for the purpose of DNS Spoofing an official website - Godofdeathftw - May 31, 2019
(May 30, 2019 12:26 PM)YadaYadaVad Wrote: I asked it to be moved to Beginner hacking Subforum, you dont need to do anything, it will be moved there eventually
Thanks man, I appreciate it!