[shvm0396]

Hi there, I am trying to execute MITM attack using SSL strip.. But its not working on sites like facebook,twitter, gmail.. Is there any fix or substitute to sniff passwords from these sites over a WIFI network..

I am using Kali Linux OS and arpspoof and sslstrip for this attack. please help.

[pomwtin]

Ye, those sites are using HSTS. You can bypass this by using sslstripv2+dns2proxy if target is navigating to webpage by browser, or cacheraser if target is navigating to webpage via url.

Also, give it 30 min and lookup what this HSTS is... it will be more clearer what I am speaking of then, how it works and how to get past it

[shvm0396]

okay .. thanks for help.. I will check this out .. I was surprised to see that most banking sites do not use HSTS .. they can be stripped simply through sslstrip..

---

Have you tried bettercap to bypass HSTS ?

[pomwtin]

okay .. thanks for help.. I will check this out .. I was surprised to see that most banking sites do not use HSTS .. they can be stripped simply through sslstrip..

---

Have you tried bettercap to bypass HSTS ?

Usually bank sites forces ssl or do not work at all without encryption, at least this is what I noticed till now... Of course it will depend from bank to bank, but it would be a bit foolish not to force https...

I believe bettercap uses method with sslstrip v2+ dns2proxy

[shvm0396]

okay i'm gonna try bettercap then.. and will let you know the results.

[bo0m]

try mimf framework

[Reptile-Ermac]

okay i'm gonna try bettercap then.. and will let you know the results.

its ettercap mate ! there are many apps to do that . Use zAnti or SSLStrip to strip https to http.Then use packate capture to finish the rest of the work bro ✌

[pomwtin]

its ettercap mate

No, bettercap is in generall better

[azag]

it'll not work unless you make the phone , pc or whatever accept your certificate .. or just dns spoof the targeted websites you wanna sniff