How to Defeat SSL in Practice with SSL Strip « Null Byte :: WonderHowTo

SSL stands forSecureSocketLayer. It's an encryption standard used on most sites' login pages to avoid their users' passwords being packet sniffed in simple plain-text format. This keeps the users safe by having all of that traffic encrypted over an "https" connection. So, whenever you see "https://" in front of the URL in your browser, you know you're safe... or are you?In thisNull Byte, I'm going to show you how to perform a MITM (Man-In-The-Middle) attack on someone via ARP poisoning. ARP poisoning is a technique used to trick a client into thinking that your computer is the router, and to forward all their traffic to you. This allows you to sniff out all the traffic before sending it to the actual router.After that, we are going to strip the SSL layer as well, so you can intercept any login, even logins "protected" by SSL. There is a new tool out called BEAST, which decrypts SSL/TLS via an encryption flaw. However, we will be usingMoxie Marlinspike'sSSL Strip which removes the SSL layer, but makes the connection appear to be normal.How SSL Strip WorksAn attacker picks a target to attack. After, they spoof themselves to appear as the wireless access point by making their Media Access Control (MAC) address identical to the router's. While they appear to be the router, they send packets to the client/target requesting their packets, thus creating a MITM topology.The client then forwards requests to the attacker, and the attacker takes the requests and retrieves them from the server for the client. After they recieve it, the SSL layer gets stripped and the page is sent to the target. The victim then forwards their packets to the attacker unknowingly, while their private information is picked out of it. SSL Strip puts the SSL layer back on, fills it out, and sends it to the server. Everything looks fine to the server and client, except the attacker gets the information they desire.This is going to be done using Linux, because Windows does not have wireless drivers capable of going into monitor mode. I suggest trying this on yourself on a home network, with two laptops and your friends.WarningsDon't perform this on people in public, this is a proof of concept to show you why SSL is still vulnerable, and how you can protect yourself usinga guideI published previously. Do this on your home network, or you will get caught.Step1Tools Needed for SSL StripThe following tools can be found in any package repository:dsniffsslstripiptablespythonpython-twistedettercapwiresharkIn Arch Linux, I do this command in a terminal to download and install them (Ubuntu users, replace "pacman -S" with apt-get install"):sudo pacman -S dsniff iptables python2 python-twisted ettercap wiresharkNow, download SSL Strip from Moxie, while following the install instructions onhis page.Step2Sniffing Traffic (Non-HTTPS)Get your wireless card into monitor mode, so you're capable of sniffing traffic.sudo ifconfig wlan0 down && sudo ifconfig wlan0 mode monitor && sudo ifconfig wlan0 upNow, run wireshark in a terminal to capture airborne packets.sudo wiresharkLook in the packet information for usernames and passwords in hexadecimal conversion.Step3Sniffing Traffic (Using HTTPS)When these commands are entered in the terminal, you need to leave them running, so open a new tab or terminal for each running command.First we need to scan the local network for our target IP. This means we are pinging everyone on the local network and when we get replies, we can see their IP and pick them as a target.sudo nmap -sP 192.168.1.0/24Make sure to paste your test computer's IP somewhere, maybe in a text document so that you can paste in the commands later.Next, we need to enable IP forwarding: (This allows you to forward traffic to/from a client, port and interface that you specify.)sudo echo 1 > /proc/sys/net/ipv4/ip_forwardNow we need to set up our interception. This tells your iptables that you want to pre-route your incoming port 80 traffic (HTTP) to 1024, because this is where you will be sniffing your traffic from.iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 1024It's time to ARP poison your second computer to make it send traffic to you.sudo arpspoof -i [interface] -t [router ip, target ip]Next we strip the SSL layer off our target, taking the encrypted layer off to be forwarded to our victim (it even puts the favicon back on so it looks like it's still HTTPS!). Change directories to wherever you saved SSL Strip before typing this.python sslstrip.py -l 1024Finally, set up ettercap to capture traffic between you and the client.sudo ettercap -Tq -i [interface]Now, go log in to an SSL page, or tell your friend to log in to one, and you will get their traffic. It's simple, and most of this could be tossed into a script for fast attacking.How Can I Defend Myself?Don't use Wi-Fi you don't trustTunnel your traffic back home, if you must use public Wi-Fi. You can find a good guide, written by me forWindows, andLinux.Don't access sensitive sites on-the-go!Jump in the IRC channel by followingthis tutorialto ask me and other members questions, one-on-one!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage byclshackRelatedHow To:Encrypted Sites May Not Be Safe to Visit Using Chrome's Default SettingsHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Perform Google searches over SSL when using Mozilla FirefoxHow To:Patch the SSL Bug Without Updating Your Jailbroken iPad or iPhone to iOS 7.0.6How To:Build a free SSL VPN on Linux or WindowsHow To:Configure F5's FirePass v7 SSL Endpoint SecurityHow To:Hack SSL passwords with ARP poisoningHow To:Use SSLStrip to remove encryption from browserHow To:Sync Your Google Contacts with Your iOS Device Using CardDAVHow To:Inject Payload into Softwares via HTTPHow To:Scan for Vulnerabilities on Any Website Using NiktoHow To:Add Your iCloud Email Account to Your Galaxy Note 3 or Other Android DeviceHow To:Secure your Gmail accountHow To:Quickly Encrypt Your Web Browsing Traffic When Connected to Public WiFiHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItMastering Security, Part 1:How to Manage and Create Strong PasswordsAnonymous Browsing in a Click:Add a Tor Toggle Button to ChromeNews:Apple Developers Running Beta Builds of iOS 7.1 Still Vulnerable to SSL Security FlawNews:The Fog of WillNews:This guy ins mixing killer DNA.  Watch out!Math Craft Monday:Community Submissions (Plus How to Make Mobius Strips)