[Bone85]

Is the attack aborted then?

[⒤⒞⒰⒭⒰⒪⒦]

Is the attack aborted then?

??

no just let arp spoofer and sslstrip keep running, Once the target system"s" login to a https website then log file will have there login data.

You just got to let the services keep running untill they make a login. And it will keep running on the network untill you decide you want to stop by closing the terminal shells.

Also the sslstrip terminal shell window itself will show data once a login is made.

[Bone85]

The vic is offline :D. He restarted the router :D. Because there is no dns resolution.

The sslstrip log tells me: Host resolution error. DNS lookup failed: address wpad.XXXXXX.ip not found.

I followed the HAK 5 tut exactly.

[⒤⒞⒰⒭⒰⒪⒦]

The vic is offline :D. He restarted the router :D. Because there is no dns resolution.

The sslstrip log tells me: Host resolution error. DNS lookup failed: address wpad.XXXXXX.ip not found.

I followed the HAK 5 tut exactly.

Ok well keep to it glad to hear you got it working out and hak5 is ownage xD

anyways yea next time just run the arpspoof/sslstrip dont do a dns attack.

You should really just do the dns attack if you are trying to get the user to a custom login page you made or to download a file. Otherwise the arpspoof/sslstrip should allow you to get all there website logins.

[Bone85]

Did dnsspoof disturb ssl strip?

How could my rat bypass avira antivir free edition?

The rat's i know, which are out of a tool, will be simple detected by av's.

[⒤⒞⒰⒭⒰⒪⒦]

Did dnsspoof disturb ssl strip?

I think running a dns spoof attack along side sslstrip might cause errors yea.


In the MiTM hak5 tut they dont do a dns spoof attack do they ?

Anyways If you do want to dns spoof attack just dont run the attack while sslstrip is running. But you do need to have arp spoof running while you do a dns spoof attack.



Just get a good paid crypter for your RAT or follow my tut here
https://hackforums.net/showthread.php?tid=4802039


Also I would suggest using netcat as your RAT

ncat runs on all OS windows/linux/mac/iOS/android

meaning your server and client can be on any OS. target OS wont matter :)

just search into making a reverse connection RAT with ncat

Or netcat hook cmd/shell reverse socket connection.

[Bone85]

I dont want the rat on my host system. Is that possible to send the rat only over my virtual machine with kali linux to the vic? I think so, because it should be linux based :D.

Do u have experience with hacking a Ubiquiti Edge Router. I have full access to the web interface. But i don't know the login information. The standard username and password dont work.

Open ports:

HTTP, HTTPS, DNS

[⒤⒞⒰⒭⒰⒪⒦]

I dont want the rat on my host system. Is that possible to send the rat only over my virtual machine with kali linux to the vic?

Do u have experience in hacking a Ubiquit Edge Router. I have full access to the web interface. But i don't know the login information.

you can host the RAT anywhere you like as long as the target can access it.

I would just create a webhosting account or ftp account and upload your RAT there.. And then its not on your system, And make a php/html page that downloads that file as afake browser or windows update.

Then when you do decide to do a dns spoof attack you can redirect traffic to that website with your RAT/Fake update.



As for cracking into the router yea just use a brute forcer like hydra or ncrack, Or lookup the defualt login for that router type.





OHHH ok I see you mean host as in the socket server of the RAT.


You can avoid this by using a botnet and not a RAT or use a VPN that supports port forwarding on the system you will host the RAT server socket on.

A botnet is a RAT that works on a webserver so you dont need to host the server socket on any system rather the website itself is the server host.



But yes if you use netcat RAT then you can run the server socket host on the linux OS and port forward it past router/modem once you can login to it im guessing.

Or you could use a cheap vpn like nvpn and just bypass that router all togeather.

[Bone85]

Default username and password didn't work.

I tried medusa and hydra, both show me password cracked x times. But it isn't. A false positive.

If you dont know the user name, u have to bruteforce both? The password and the user name?

The os on the router is edgemax.


Is there no exploit?

[⒤⒞⒰⒭⒰⒪⒦]

I tried medusa and hydra both show me password cracked x times. But it isn't. A false positive.

If you dont know the user name, u have to bruteforce both? The password and the user name?


Is there no exploit?

As I said you can avoid using the router to port forward by using a cheap vpn that supports it like nvpn.


As for cracking it no exploits off hand I know of, I would try using ncrack to brute force the login.

And if you dont know the username then yes you need a wordlist for both username and password. But ncrack shouldnt give any false positives its pretty reliable.



This is the only exploit I found off a quick skim online
http://community.ubnt.com/t5/EdgeMAX/sec...-p/1025659


But that isnt going to help us at all from what I gather.


You could try arp spoofing the target and do a dns spoof that forces target to the router login page when they type in any web address thus forcing the user to login to there router and then you can capture there login to it that way.

[Bone85]

This takes years?

Cracking WPA2 handshakes take years, with 20 random digits strong password.

If you have no GPU based server farm, like an intelligence, you can't crack it with bruteforce attack.

And this is GPU/CUDA based, on a GTX 980 TI with ~98 % GPU load.

Pyrit didnt work with db attack. So I had to use ocl hashcat.

[⒤⒞⒰⒭⒰⒪⒦]

This takes years?

Cracking WPA2 handshakes take years, with 20 random digits strong password.

If you have no GPU based server farm, like an intelligence, you can't crack it with bruteforce attack.

And this is GPU/CUDA based, on a GTX 980 TI with ~98 % GPU load.

Pyrit didnt work with db attack. So I had to use ocl hashcat.

haha

you are not cracking a wpa key the router web based login doesnt use wpa to login thats for the wifi signal connection.

If you are trying to crack the password encryption of the wifi signal thats cracking wpa.

The router login is just a basic http login brute force attack.

[Bone85]

Yep, I know. It takes much, much more time. Especially if the router rejected your request.

And if a WPA 2 handshake takes years with 1 variable, and x 1000 passwords per second, you can imagine how long a https based attack with 2 variables takes.

Is there a way to transfer a wpa handshake into a md5 hash ?

[⒤⒞⒰⒭⒰⒪⒦]

Yep, I know. It takes much, much more time. Especially if the router rejected your request.

Is there a way to transfer a wpa handshake into a md5 hash ?

not that I know of,

Code

you can imagine how long a https based attack with 2 variables takes.

This isnt really correct at all. wpa cracking is not http post data brute forcing. Not the same at all..

http brute forcing isnt really even cracking it doesnt decrypt or crack any strings or values.


So now you need to crack the wifi password lol....😶

Well if the wifi is using wpa/wpa-2 then cracking it is gonna be a pain no doubt.

And will all depend on how large your database is on cracking it as it works off a list, It cant auto crack off handshakes like wep type encryptions.


Another option could be a wps exploit.

Most routers nowadays have a wps option and the defualt data for this isnt changed much, And its a exploitable service on many routers.

Hacking the wps key may be much much easier than hacking the wpa at times.

[Bone85]

There is no wps activated (no pbc and no pin) . This is a modern router with newest firmware. If wps has been manually activated, it will turn it automatically off, after 2 minutes.

11000 Pins are better then billions of passwords :D.

Do you have experience with DLink routers and wps lock ? mdk 3 and aireplay wont shut down the router in order to lose the lock.

The dlink default pin script doesn't work. It's another pin.

Why is here no https available? The login on this site could be easily sniffed by a man in the middle attack :D.