Sniff Https / Https (sslstrip) - aneb proc jsem paranoidni...

[petrakis]

Nebudu to moc rozvadet, prilozim to vse v originale v anglictine. Ti kteri neco vedi o tehle problematice , tech par slov urcite pochopi. Tento post nema slouzit jako, vyukovy material pro "script kiddies", jeho cilem je spis priblizeni zpusobu ktere se pouzivaji pri technice "Man in The Middle" take pri https spojeni. V pripade ze video na uvedenem linku jiz nebude aktivni, dejte vedet, a ja ho uploadnu jinam.

A video on how to sniff HTTPS / SSL!

What is this?
This video shows that with SSL encryption, it isn't any more secure. Proof of this is seen by showing my web based email (Google Mail) & online bank (PayPal) password...

How does this work?
> Performing a 'Man In The Middle' attack therefore all the traffic flows through the attacker.
> Picks out HTTP traffic from port 80 and then packet redirection / forwarding onto a different port.
> SSLStrip is then listening on that port and removes the SSL connection before passing it back to the user.
> ettercap then picks out the username & password.

What do I need?
> sslstrip
> arpspoof
> ettercap
*all in BackTrack 4 Pre Final*

Commands:
Targets IP: 192.168.1.6
Gateway : 192.168.1.1

Notes:
You could save the packets instead, and then look through it later, in case ettercap doesn't pick up the information you need!

Links
Stream Video: How to: Snifff SSL / HTTPS (sslstrip)
Download Video: http://www.mediafire.com/download.php?jzt2kmmdzzr
Commands: http://pastebin.com/f2b34793e

Software
Name: sslstrip
Version: 0.2
Home Page: http://www.thoughtcrime.org/software/sslstrip/index.html
Download Link: http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.2.tar.gz

Name: arpspoof (DSniff)
Version: 2.3
Home Page: http://www.monkey.org/~dugsong/dsniff/
Download Link: http://www.monkey.org/~dugsong/dsniff/dsniff-2.3.tar.gz

Name: ettercap
Version: 0.7.3
Home Page: http://ettercap.sourceforge.net
Download Link: http://prdownloads.sourceforge.net/ettercap/ettercap-NG-0.7.3.tar.gz?download

Na zaver puvodni odkaz na autora co to vse zpachal:
http://www.forums.sajidsaif.com/linux/5024-video-tutorial-how-snifff-ssl-https-sslstrip.html