yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] MewRai95:
Go ahead, in fact it was adb on my pc that I used for the logcat anyways so feel free to PM me
[Android Apps and Games] evilsocket:
PMed
[Android Apps and Games] mDroidd:
This app is just great, really!

But I do have one suggestion.

A "Multi" option in the settings menu.

Toglle it, and all found IP adresses will get a checkbox.

At the bottom of the page will appear a "Choose spoofs" button.

When that button is clicked, the spoofs that are available for multiple IPs will be available (kill, sniff, hijack, redirect etc).

That would be the only option I would still like to see :) tell me if it's already present lol
[Android Apps and Games] MaxRabbit:
The app and the support you are providing for it is amazing. Thank you.

That being said, attempted MITMs: redirect, kill traffic, and session hijack with latest app against my laptop and had no results. No HTTPS. Let me know how I can help you.

PS What a beautiful website. How did you make it?
[Android Apps and Games] evilsocket:
Multi selection is planned for a future release :)
[Android Apps and Games] evilsocket:
https is still experimental and i'm working to improve mitm attacks ... the website was made today in 10minutes thanks to the bootstrap framework ^^
[Android Apps and Games] evilsocket:
btw https module works like ssltrip, so:

the mitm proxy strips out every https:// links in browsed http webpages

the user click on a http link ( which was an https one ) and connects to our device

the proxy handle this case creating a client ssl connection to the real server

everything goes like a normal http session

Therefore, if you browse directly to an url such https://mail.google.com/ dSploit can't handle this ... yet :)
[Android Apps and Games] MaxRabbit:
Sorry, my bad. I meant that I was not using HTTPS, using only HTTP, and had no results.

I wonder also how many friend requests you've had on Facebook since you posted your info :P I know I did it!
[Android Apps and Games] evilsocket:
Hahahah well, not as much as you think :)

Anyway ... try to disconnect and reconnect other devices from the network ( if you can ), then restart dSploit ... sometimes the arp table goes s**t and this is the only way to make MITM works.
[Android Apps and Games] metalwraith:
In regards to your site I was bored... if anyone wants to use it... If you don't mind that is? :confused:

Considering it's my first time actually doing much with gimp I think it came out decent... Typically I use photoshop in a virtual session of XP or Win7..

Added you on Twitter as well.
[Android Apps and Games] evilsocket:
THANKS! :D Gonna put it on my signature right now :D
[Android Apps and Games] metalwraith:
Your most welcome.
[Android Apps and Games] MegaHz:
nice website dude!

yeah i've been testing mitm https and seems to not work as "expected" it managed to hijack some sites successfully but most of them it took me many logins/logouts to hijack it.. maybe is the timeout of the session or something. i will do some more tests and let you know.

also, i don't know if it was mentioned before, can we do a password sniffing while session hijacking? or the opposite? i mean 2 or 3 tools can be run at the same time. This would be awesome, it would complicate the interface, but from the elements that we've seen from you until now.. everything are put together nicely!

also can we have password sniffing in mitm for https?

thanks
[Android Apps and Games] avrano1:
I think there is something wrong on your website:

:p
[Android Apps and Games] evilsocket:
this was already asked many times :)
[Android Apps and Games] evilsocket:
asd tnx, kinda sleepy ( 23.30 here )
[Android Apps and Games] MegaHz:
sorry couldn't find it in the todo.
[Android Apps and Games] evilsocket:
multi target and multi modules at the same time are going to be implemented in a future release.
[Android Apps and Games] metalwraith:
LOL Late night... only 5:30pm here...
[Android Apps and Games] MegaHz:
thanks, can we help you somehow in making https mitm better? we could provide test scenarios and logs maybe?
[Android Apps and Games] virtualflyer:
Grazie! I'll keep on trying so.

Btw I've two suggestions, very easy to implement for the brute force attacks. First you should add screen wake lock, so that it can last as much as it needs, or make it able to work even when screen is off, second I think you should add the possibility to try combinations with more than 6 characters, yes I know it takes really much even to try four characters, even if I have a one x, but I think that choice is always good (that's the reason we don't have an iphone, isn't it?) and if we have very very much time and battery and heat to waste, let us do it! :D

Edit:forgot to mention it, but we need portrait mode!!

Inviato dal mio HTC One X con Tapatalk 2
[Android Apps and Games] umpire7777777:
Try using 1.20. I tried the latter two patches .1 and.2 and dsploit failed to load missing the killall busybox component. Those patch releases seem incomplete.
[Android Apps and Games] sotoskawasaki:
The development on this app is simply amazing. Almost daily updates fixing bugs and introducing new features. Looking forward to future releases. Also kudos on the website. It would be nice if you also made some kind of tutorial, how to, or help. Anyway, keep up the good work. By the way I have some trouble with mitm attacks, nothing seems to work but I will give it some more tries before coming back. Kudos again!!
[Android Apps and Games] Ruzzah:
Have you fixed it not listing all ip's in the range?

Needs to check 192.168.X.Y
[Android Apps and Games] crystal eyes:
I'm impressed on you work. All other module except mitm works with me. On mitm only kill connection is working/ others they just reset my router. On droidshepp and dsniff work perfectly without trouble and they are fast.

I have galaxy note 4.0.4 official rom

---------- Post added at 12:41 PM ---------- Previous post was at 12:30 PM ----------

Mine too. i think It is rom/phone issue. That is what happened to my galaxy note from Korea so I decided to buy the gt-n7000 galaxy note
[Android Apps and Games] evilsocket:
Thanks but no, i don't need help on this :)

I don't think 6 chars would be useful for the reason you've already said, portrait mode maybe in the future :)

Yeah gonna put video tutorials on the website ;)

No, that's a nmap bug, not dSploit's ... gonna check anyway.

Thanks :) MITM modules have some problems due to ettercap not working every time, gonna switch to arpspoof, we will see :)
[Android Apps and Games] virtualflyer:
Ok, I can understand your position, but I always think more freedom is "more" better. Choice is ours, but obviously as you prefer!!

With portrait lock apps it works like a charm!

Thanks for the great app!!

Inviato dal mio HTC One X con Tapatalk 2
[Android Apps and Games] evilsocket:
I could put that 6 chars limit in no time, so it's no a matter of implementation ... i just find this useless ... anyway, as you whish, no problem for me :)

Yeah the app works in portrait mode too if it's forced to, but try to rotate the screen while some operation is in progress ... boom! :D
[Android Apps and Games] crystal eyes:
The man was right, It is useless. The phone does not have the power of a desktop or laptop to do that.
[Android Apps and Games] Ruzzah:
airmon-ng and airodump-ng require monitor mode, I was wrong.
[Android Apps and Games] evilsocket:
this is wrong ... aircrack ( airmon-ng and airodump-ng ) needs monitor mode to read and inject packets to the wireless network, without this you'll just have the aircrack-ng utility working which is used to bruteforce/crack sniffed handshakes/packets/whatever ... and aircrack only is useless.
[Android Apps and Games] crystal eyes:
ya aircrack-ng does not require monitor mode, but it is useless because in order to use aircrack-ng, you have a pcap file or so. The question is how to get that file, It uses airmon-ng then airodump-ng that uses a card with monitor support in order to work
[Android Apps and Games] Ruzzah:
Hmm you're right, the monitor mode is for injecting packets, my bad!

Can you use 192.168.0.0/16 instead of 22, this will pick up 192.168.0-255.0-255.

Thanks
[Android Apps and Games] evilsocket:
The subnet mask is computed at runtime, so if you have /16 it is /16 i guess.
[Android Apps and Games] evilsocket:
1.0.25b is out!

Changelog:

Implemented changelog dialog on first application launch ( on every update or new installation ).

Better tool installation process.

New website link in about dialog.

Fixed issue #52 : MITM filters don't work the first time ( switched to a patched arpspoof ) PLEASE CONFIRM ME MITM MODULES ARE STABLE NOW.

Implemented cookie session killer for HTTPS Hijacker Module ( make clients logout so we can get fresh cookies from stripped https websites ).

Fixed issue #35 : LD_LIBRARY_PATH bug ( well it's not really fixed, but the user gets a message if his rom is not compatible due to this bug ).

Fixed issue #74 : Proxy and server port are now configurable.

Fixed wake lock acquisition.
[Android Apps and Games] nikant:
I didn't notice any message in my ROM.. still it shows only 3 targets as before.. any chance of real fix in the future?
[Android Apps and Games] evilsocket:
this is good, because it means your issue can be fixed ... i'm working with a friend of mine who has the same bug of yours to solve this as soon as possible.

Thanks for your patience.
[Android Apps and Games] nikant:
Thank you for your effort! :thumbup:
[Android Apps and Games] :
FYI this works 100000% better! faster too! everything that previously was hit or miss was working first try every time!
[Android Apps and Games] evilsocket:
I'm soooooooo happy!!!! It was an ettercap bug ( not dSploit's! :( ) so i had to take arpspoof instead and manually fix the C code of it because on my device it just crashed on a segmentation fault ... wow i can rest a little bit now :highfive:
[Android Apps and Games] crystal eyes:
Ok thanks for the update. I wil download ang test if mitm works without crashing my router
[Android Apps and Games] frodsu:
Thanks man, now it's faster and all seems to work great :) Cant wait to pwn some friends :)

I am running galaxy tab 10.1 with Toldo's jellybeanicsroom v7
[Android Apps and Games] virtualflyer:
Yes I know, but I always think we should impose as few limitations as we can, mostly when it's so easy to remove them. Idk if you understand me, but I see the thing 'you can't do this because it would be useless/slow on your phone's much more like an apple thing, not an Android one. But it's up to evilsocket to decide what he wants to do ; )

Inviato dal mio HTC One X con Tapatalk 2
[Android Apps and Games] evilsocket:
Dude i've got it, but i don't think you are going to stick a jackass tail on your nose "just because you can do it and you don't want limitations" :D

Why should i put a feature which:

a) It's useless as it's been already said.

b) Could make the user think "this password module really sucks! The progress is the same as two hours ago!"

c) Wouldn't be useful even on a desktop pc ( consider a complex charset and do some math ).

? :)
[Android Apps and Games] crystal eyes:
Now mitm works. Sessions hijacking also works. But now notification continues dven I exited dsploit. The only way to stop is by rebooting my device
[Android Apps and Games] evilsocket:
dSploit usually stays in background, have you tried to close it from your background task manager ( third soft key on ICS ) ?
[Android Apps and Games] crystal eyes:
Ok... thanks

---------- Post added at 08:42 AM ---------- Previous post was at 08:33 AM ----------

Before that is what I do prior to 25b version. Maybe my device is the problem or some apps interfere with dsploit. Sometimes that is what happened even droidsheep
[Android Apps and Games] evilsocket:
mmm kinda strange, i haven't made any modifications to the code which handle background processes ...
[Android Apps and Games] crystal eyes:
Yeh, strange. I think the router which run on radius server. We currently have 350 plus clients connected to it. So my analysis: because of that number of clients, there is a delay in the notification. Now I transferred to my private router,I cant replicate the same problem as before
[Android Apps and Games] evilsocket:
Yeah probably it's just the notifications queue you are looking at, in this case, you can disable them from dSploit settings menu ;)
[Android Apps and Games] Ruzzah:
Can you get dsploit to close when no scans are running, and if there is can you put a notification that does not go away until properly closed?

Thanks
[Android Apps and Games] EdgaBimbam:
session sniffer doesnt work when i choose network router as victim, when i choose for example my laptop, session sniffer works but gives direct domain but with logged acc, later resuming scan doesnt give any results at 25b version
[Android Apps and Games] dt0x:
I haven't had much luck getting the Session Hijacker to pick up any HTTPS sites. Tried testing it on my Facebook without https turned on, and it worked. Turned https back on and it wouldn't pick up anything. It picks up xda with no problem. Other than that, great app!
[Android Apps and Games] kosivi:
I think this is the reason...
[Android Apps and Games] virtualflyer:
Yeah I got your position too, was just trying to explain to the other guy. I'll keep thinking it would be better, but as days it's up to you!!

Non volevo insistere!! Fai come preferisci!!

Inviato dal mio HTC One X con Tapatalk 2
[Android Apps and Games] evilsocket:
i don't see the point in this.

It's normal, the router itself doesn't make much network activity ( think about it, in mitm YOU are the router ) ... chose the subnet ;)

It's working as expected for reasons i've alread explained :)

Yep
[Android Apps and Games] EdgaBimbam:
if i choose subnet it doesnt find nothing at all :)
[Android Apps and Games] evilsocket:
mmm kinda weird ... gonna check, tnx ;)
[Android Apps and Games] EdgaBimbam:
also when i choose my router as victim, tried killing connection, replace pictures and it wasnt working while choosing specific victim for example my laptop, those features work, seems that somehow using victim router fcked ;D o.O
[Android Apps and Games] evilsocket:
was it working before 25b ?
[Android Apps and Games] EdgaBimbam:
yes was working before. With 22b as i remember. I can test.

with 24v working while choosing router as victim

edit: with v24 also works those features with subnet mask as victim. Something wrong in v25 ;D
[Android Apps and Games] Ruzzah:
The main point for this I believe would be so you can exit the application without stopping the sniffing, so you can continue doing whatever you were while knowing that the process is still running and being able to click on the notification to open up the page again.
[Android Apps and Games] evilsocket:
You can simply send the app to background and then reopen it once you have done ... it would mean adding a feature to replicate something which is already Android native.

The only difference is that dSploit notifications won't open dSploit ... that's all.
[Android Apps and Games] riahc3:
The site looks very nice :)

Is the latest version downloaded from there now?

---------- Post added at 06:08 PM ---------- Previous post was at 06:01 PM ----------

Seems like performance has slowed down in the latest version....

---------- Post added at 06:16 PM ---------- Previous post was at 06:08 PM ----------

Wow......OK never mind.

I highly recommend you detect if SuperSU is installed. I changed to SuperSU and the performance of your app just mutilpied by 1000000. Amazing.

---------- Post added at 06:22 PM ---------- Previous post was at 06:16 PM ----------

The redirect feature is slow, although you have commented on this that this is because ALL traffic passes thru the Android device.
[Android Apps and Games] evilsocket:
Yep the website is automatically udapted with the latest version to download.
[Android Apps and Games] riahc3:
BTW, does this sniff WhatsApp conversations? Just outta curiosity.
[Android Apps and Games] evilsocket:
no, whatsapp uses a proprietary jabber modified protocol and there's no dissector for it right yet.
[Android Apps and Games] jamcar:
How could i do the javascript injections from a computer?
[Android Apps and Games] evilsocket:
you'd need a webserver on that computer which servers the js
[Android Apps and Games] riahc3:
I asked because of that WhatsAppSniffer that was around some time ago (I think it doenst work because of HTTPS now right?)
[Android Apps and Games] evilsocket:
Right.

A little "building an apk" howto here, if you want to contribute to the project, take a look :)
[Android Apps and Games] defconoi:
Can anyone confirm that the searching for endpoints works on the galaxy nexus with cm10? Not finding any hosts still

---------- Post added at 04:48 PM ---------- Previous post was at 04:44 PM ----------

Same here on gnex
[Android Apps and Games] riahc3:
I thank you for inviting me but although I am a Java coder, I got stuck at "Hello World" :P Damn XML files....

Ill just contribute with ideas :)
[Android Apps and Games] metalwraith:
Off to the laundromat tonight.... good ol' laundry and my Nexus 7 and headphones.... *wink wink nudge nudge* ;)

---------- Post added at 11:25 PM ---------- Previous post was at 11:23 PM ----------

Oh and free wifi....lol
[Android Apps and Games] Ruzzah:
Again this app does not pick up all IP's on different subnets on the same network. Pictures are provided of another app that lists all properly. Please fix this.

Edit: the app picks up the IP's when sniffing however sniffing a specific IP still shows all IP's. Last screenshot.
[Android Apps and Games] Ruzzah:
Wtf can't upload to forum with tapatalk...useless
[Android Apps and Games] frenzyboi:
Congrats! Your application seemed to have been published here ;)

http://www.pentestit.com/update-dsploit-1023b/
[Android Apps and Games] defconoi:
Does this app use ARP to discover IPS? It doesn't work with the galaxy nexus. I think a ping sweep would be more efficient with icmp
[Android Apps and Games] RootTheMachine:
I'm having an issue with the session hijacker with https. I can get it to work just fine with my twitter account, but only the first time I try it. After that, it appears with the lock symbol in dSploit, but clicking on it only gives me the login screen. I also noticed that if you stop the session sniffer and re-start it, no traffic will appear. It will only work again if I back out and choose it again.

When it works, it works good though. Nice work. I'll definitely pay/donate for this.
[Android Apps and Games] kenmaples:
I did a search and check the faq, but I apologize if I missed it. Are there any plans to allow the app to monitor traffic when the phone is running wifi tether?

Thanks!
[Android Apps and Games] ProfessorHipster:
I used Busy Box Installer by Stephen (Stericson). It is in the app store. I would post the link but I am a new user:/
[Android Apps and Games] ArmedandDangerous:
There you go

https://play.google.com/store/apps/details?id=stericson.busybox&feature=search_result

I'm using this one too.
[Android Apps and Games] riahc3:
I highly suggest anyone using this to install SuperSU Will make performance A LOT better...

https://play.google.com/store/apps/details?id=eu.chainfire.supersu&hl=en

http://xdaforums.com/showthread.php?t=1538053
[Android Apps and Games] EdgaBimbam:
damn this app requires root, root always as i know comes with supersu or superuser...
[Android Apps and Games] riahc3:
New bug: When only on 3G, the message pops up saying it only will detect for updates. You turn on Wifi and it doesnt "activate". You have to close/get out of the app and restart it so it can work again

Weird bug: When I open THE FIRST TIME, after 10 seconds or so (I state this so you know that it has indeed scanned and is showing IPs), the menu hitting the menu button, it still shows "Start Network Monitor". But I close the menu and open it again it shows "Stop Network Monitor"

Yup, something like this always needs root :)

Another bug: Simple sniffing breaks internet access on my work network so there are some side effects it seems....You might want to revise that code to make sure it doesnt do things like these as it can cause headaches when this is also a network testing suite :)
[Android Apps and Games] EdgaBimbam:
for me v25 is buggy, went back to v24 ;D
[Android Apps and Games] evilsocket:
The command line i use to find hosts is :

nmap --max-retries 1 --max-rtt-timeout 250ms -sn -n -T4 --system-dns YOUR_SUBNET_HERE

Here

The first one is not really a bug, the app just don't listen for wifi configuration changes :P

I'll inpsect the second one, tnx for reporting.

The third one depends on your device, but i will try to optimize the transparent proxy.

Explain better plz.
[Android Apps and Games] crystal eyes:
I think Dsploit is not yet as good with the apps like droidsheep or droidsniff with regards to mitm. I in our haws, my phone works with mitm most of the time. Also on our wifi network which uses a radius server. But today, I tested it with a public wifi. It doesn't work at all. It can not even detected any clients but on droidsheep and droidsniff, my phone work flawlessly.
[Android Apps and Games] evilsocket:
DroidSheep uses arpspoof, dSploit uses arpspoof too now ( same command line, same binary ), so sorry if it seems like i don't trust you ( i do trust you ) but this seems kinda weird.
[Android Apps and Games] riahc3:
Is this something you ment or will you change this? From reading it, it sounds like its something you ment for it to be like this :)
[Android Apps and Games] evilsocket:
Ahahaha honestly i was just too lazy to implement this :D working on it right now :)
[Android Apps and Games] riahc3:
Um, DroidSheep and DroidSniff only have ONE MITM attack..... Session Highjacking. Nothing else. This has that and then some.

I, like evilsocket, have my doubts on your claims especially if it uses the same method. Install the latest version and restart your phone.

---------- Post added at 11:05 AM ---------- Previous post was at 11:03 AM ----------

:P OK

Its not being picky evilsocket; Just when you want are heading to release a final version, these little things make it look a little less professional :)
[Android Apps and Games] evilsocket:
I know, that's why your help is so precious to me ... testers can see things i don't see ( like drunken unicorns :D )
[Android Apps and Games] hurin8:
Tested it on a public wifi and did a comparison for session hijacking. dsploit found 2 fb accounts, whereas droidsniff found 5 and faceniff 7.
[Android Apps and Games] dexter93:
Weird. It works nicely on my university's Cisco routers, but not on my home's Netgear router.. also works on a Belkin router I tested. It wont even pick up the other devices. Does that mean my firewall is properly set up? :D

Also, cant get redirect and content replacement functions work on any router I tested. I'll give it a try again later and get logcats
[Android Apps and Games] evilsocket:
tnx :)
[Android Apps and Games] crystal eyes:
My post was correct. Im testing it right now. I dont know what happened but prior to 25b on this same public wifi it can detect clients but mitm did not work. Then after the update to 25b, I test it with my router, mitm works and clients are detected. But for the oublic wifi that uses rukus server, 25b does not work
[Android Apps and Games] riahc3:
I imagine you ment radius server...

You cant really access anything on the radius server (or anything thru it) as you have to authenticate against it.

Its something like this:

You have a public wifi with no key and a radius server

It is the same thing as

A public wifi with WPA2 key and no radius server

A radius server is a lot more secure (for a public wifi WPA2 is more than enough)
[Android Apps and Games] ObiWan_C:
I don't know if it was mentioned before but I think I found a bug with the sniffer.

When you sniff for domain that has an extension with more then one part (for example domainname.co.uk) the sniffer sees it as just co.uk

Will not show the hostname. Also if you have a domain like my.domain.com It will show only .domain.com ...
[Android Apps and Games] evilsocket:
New issue opened, tnx for reporting.