yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] SSPPYY:
It is because SSL Strip can be used only for HTTPS connections created from HTTP connection (when you click to HTTPS link on HTTP page, e.g.). For hack direct HTTPS exist other complicated method. I wrote desktop app that it do, and i working on similar algorithm for android now. When it will be finish, i can provide solution to dsploit.
[Android Apps and Games] Midaa:
But the SSLStrip works perfectly with faceniff, it even works when directly typing https:// but its too slow :(
[Android Apps and Games] SSPPYY:
Are you sure? I was using faceniff and i dont remember this feature. When you init HTTPS connection, it will create TCP SSL (TLS) encrypted connection which is unreadable using SSL Strip. Probably connection was redirect from HTTPS to HTTP and its work (even you dont need SSL Strip). Many sites uses HTTPS only for login and than redirect connection to HTTP.
[Android Apps and Games] Midaa:
You can try it. It works, but ponury has chosen to only show the first and last character of a password :mad:
[Android Apps and Games] evilsocket:
This is a known issue which i'm investigating.

BTW dSploit has active https -> http redirection besides the sslstripping feature.
[Android Apps and Games] SSPPYY:
How can you redirect HTTPS connection initialized by user to HTTP, when users browser waiting for SSL connection? You can only create fake HTTPS connection (this is what i am doing), and than use https-http proxy, or send http redirect to user, or exist another way?
[Android Apps and Games] evilsocket:
Well:

The network is spoofed, so all the traffic is first redirected to your device.

Your device forwards the traffic to the real destinations.

On your device, an iptables rule is created which redirects traffic to port 443 ( https ) to port 8082 of the device itself.

On 8082 there a simple https server which sends only 302 redirects to http service.

So:

https://website.com/ -> your device -> redirection -> http://website.com
[Android Apps and Games] SSPPYY:
Yes, classic http redirect, as i wrote. But when original server support only https, than it is not working, or you need some translate table for http to https url. For example if i have mysite, which working for http and https, but i have login url mysite.com/login.jsp which is accesable only by https, you need translate http:.../login.jsp to https:.../login.jsp. Right?

I am working on https proxy, where i have https server and for every connection i create proxy connection to original server and my https server uses fake certificate.
[Android Apps and Games] evilsocket:
I DO have that translation table ... the sslstrip one :) Once a connection is redirected to http, i add its url to the sslstripping pool ( as if it was a sslstripped https url from a http html page ) so the client talk to me in http and i talk to the remote server in https.

But yeah, maybe just a https proxy with custom certificate is better ...
[Android Apps and Games] SSPPYY:
I do not know... because if you use fake certificate, user is warned. Also, many users ignore it :)

But, when you use custom https server, you need some certificate too. What certificate you are using? Here can by problem, because some browsers may ignore http redirect whan certificate is not OK.
[Android Apps and Games] evilsocket:
i know, but either ways you need a self signed certificate ... with the simple redirection, the user has to accept it only once, with a full https proxy he has to accept it for every https site he visits.
[Android Apps and Games] SSPPYY:
Yes its true, but its nice, when you have implemented more methods and user can choose one.

And how you say, and also other user report, that it is not working properly, i think where can be problem...
[Android Apps and Games] riahc3:
And when its found...........? You cant make it "prettier" when its not found (less seen) and make it ugly as **** when it is found (more common)
[Android Apps and Games] evilsocket:
man it's a fuc*ing changelog! c'mon
[Android Apps and Games] riahc3:
Redirect is slow/unusable.
[Android Apps and Games] evilsocket:
this was already discussed tons of times ... it depends on your device power, your wifi signal strength, the amount of traffic and so on, redirect just uses the same transparent proxy of the others mitm features.
[Android Apps and Games] riahc3:
Yeah youre right! Why make pretty **** like Aroma Installer when it can be scrolled in a screen with black background and white text. You are right! Lets make **** look cheap, non native with a cheap ass native Android popup and just put a browser screen.........

Whatever. You wanted to look professional but that popup on first install looks cheap as hell.
[Android Apps and Games] Keylogger_0:
So from what I've seen, the port scanner, tracer, vulnerability finder, and NetBIOS data gathering is a known issue. (I presume)

Well, keep doing the good work! Hopefully you'll get those fixed.

Also, thoughts on aircrack-ng?
[Android Apps and Games] evilsocket:
You know, i prefer to concentrate on core functions rather than make a pretty changelog for ya ... if i'd think like you, dSploit would be a very pretty but useless app.

Hey i'm alone developing this, i have priorities.
[Android Apps and Games] Keylogger_0:
I know aircrack-ng supports only few phones, but if those phones had this functionality, it should be added to the app and only allow those certain phones to use the aircrack-ng functionality.
[Android Apps and Games] evilsocket:
i have to prioritize commonly available features first.
[Android Apps and Games] KaitoKito:
Nice update ;)

Btw I have a request : could you add an option to send magic "wake on lan" packets ? It shouldn't be very difficult to code. Also you could impove the login cracker by showing some services in a different color (like green) if they were previously discovered via the Port Scanner or the Inspector.

And last but not least why not propose your app on the F-droid repository ? (I don't have any links with them, I just like use their repository)

KaitoKito.
[Android Apps and Games] evilsocket:
great ideas! could you please open a couple of feature requests on github issue tracker ? ^^
[Android Apps and Games] SSPPYY:
I was post 2 new request for features on github, you can look at this if you will have more time...

And if you will want to integrate https proxy with fake certificates, then i have code for generating fake certificates for android complete. Now i am working on redirecting packets and we could discuss it.
[Android Apps and Games] evilsocket:
the certificate generation code would be quite useful! :D
[Android Apps and Games] anazhd:
and what is your problem riahc3? exactly, did evilsocket ask you to pay and complaint for everything? dude, for some reason, DSploit is f**cking free to use, and it's on github where we can fix bugs together and give good ideas with manners.

zAnti, DroidSheep and NetSpoof are waiting for you riahc3. i dont think you need dsploit anymore.

btw evilsocket, v30 is much better and great changes!
[Android Apps and Games] evilsocket:
thanks :) still a couple of annoying bugs to fix
[Android Apps and Games] Ruzzah:
I'm not sure but sslstrip doesn't work for Facebook, if I go to http://m.Facebook.com and try logging in, it keeps telling me to login first.

Password sniffer does not work for forms, it only seemed to work to http authentication, can you with your server check "post" requests to see if there is a field for "pass" "password" "PW" "username" "user" "email". With php its $_POST["password"] thanks!
[Android Apps and Games] evilsocket:
i will try ^^
[Android Apps and Games] ortrigger:
I'm getting constant crashes when I open .30b. Running aokp m1 and m-kernel+ a9. I can't get a logcat right now but I could get last kmesg if that would help.

Sent from my aokp'd n7
[Android Apps and Games] KaitoKito:
Done ;)

I'm not very familiar with github (expet downloading stuff from it) so if I've done something wrong please apologise me.

I've hesitate to open a feature request about the traduction into French or other language, because you don't planning to do it, but I still think it's a good idea. Maybe a low priority request ?

KaitoKito.
[Android Apps and Games] evilsocket:
known issue.

we will see :)
[Android Apps and Games] ortrigger:
Is there any way I can fix it? Or at least help find a solution?
[Android Apps and Games] evilsocket:
you should build an apk from the latest source code, or wait for the next release :)
[Android Apps and Games] ortrigger:
That'll work. Thanks.
[Android Apps and Games] orb3000:
On topic

Ok guys/gals keep on topic and with respect.

A ban may come your way...
[Android Apps and Games] tbudke:
App worked great til this update. Now it just spams my statusbar then crashes.
[Android Apps and Games] riahc3:
No problem. Sorry about that :)
[Android Apps and Games] MegaHz:
Nice cleanup of the thread.

I spotted an issue. If you start/stop the sniffer a couple of times it seems that ports are not released and dsploit warns that ports are in use and need to be changed. But apparently dsploit does not kill the process fast enough thus ports are still in use.
[Android Apps and Games] evilsocket:
You are probably using the 1.0.29b ... uninstall it, download the 1.0.30b and manually install the new version.

Yeah i've noticed it yesterday, will fix.
[Android Apps and Games] MegaHz:
Cool thanks. Another thing, can you implement "save to pcap" during mitm/session hijacking
[Android Apps and Games] evilsocket:
open two issues on github plz :)
[Android Apps and Games] :
It crashes when I use password cracker on port 23 great app though :D

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] evilsocket:
logcat plz ( and maybe open an issue on github )
[Android Apps and Games] balducien:
Portrait mode?

It only works in landscape, I don't know if you want this or if it is a bug. Please enable portrait mode, it would be so much better!
[Android Apps and Games] devrruti:
Someone said it already, you should publish this app on f-droid, an opensource apps market, maybe more developers see it and will get interested. At least put there one version that will autoupdate itself
[Android Apps and Games] Kurre:
It's intended to be like that, because rotating screen while using the app causes problems. evilsocket has explained this couple of times and I bet that he would make a portrait support if it would be easy/worth of time. But he'll probably give you more thorough explanation if he wants to ;) or you could also search for a prior posts about the matter :)

Sent from my slimbeaned GNex :)
[Android Apps and Games] evilsocket:
From http://www.dsploit.net/#faq :

I don't like f-droid and honestly i don't see the need for it, dSploit already auto updates itself.
[Android Apps and Games] Fishuu:
Idk if this has been mentioned but, I tried to MITM attack on my lappy to hijack my fb session its on secure browsing so it won't show, but it shows my brothers fb session witch is on the same network but different pc
[Android Apps and Games] evilsocket:
is the laptop on ethernet and you brother's pc on wifi ? or the contrary ?
[Android Apps and Games] KaitoKito:
About the landscape mode, Evilsocket, did you have thinked about the reverse landscape mode (for left-hander people)? Is it doable ?
[Android Apps and Games] evilsocket:
the problem is not the orientation itself, but the rotation ... the app has to stay the same orientation during its usage.
[Android Apps and Games] UEman:
Why not make an orientation option and if it is used say the app needs to restart?
[Android Apps and Games] evilsocket:
i'll see what i can do.
[Android Apps and Games] :
jonathan.hayletts.net/Log_2012-11-09_22-39-52.txt

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] evilsocket:
This is a fixed issue therefore you are using an old version of dSploit, please manually upgrade to the latest version ( 1.0.30b ).
[Android Apps and Games] KaitoKito:
Hello guys,

I've three new suggestion for dSploit but I don't know if someone have already suggested. If so please apologise me. My first idea is about the Youtube video replace function. When I want to do it dSploit request me a youtube url, it isn't really user friendly. Can you add a list of youtube videos that I previously added in my navigator bookmark ? I think a few lines of code could check all bookmarks stored in my phone, then display only youtubes bookmarks on a list, so I can choose easily which video I want to show.

My second idea is more complex. I've see that the "Simple Sniff" tool store all packets in a pcap file. Is it possible to make a function to analyse it later, when we are off the wifi network ? So we can launch the pcap recording in a sort of "sealth mode" who only record the packets (and why not continue using any other app on the phone, or not using it at all, during recording), and later analyse it to know which urls, images, passwords, etc.... we've recorded.

THe last one is to add more preconfigured packet in the Packet forger. I don't know if any packet "ready to use" exist like the Wake on Lan I've suggested some days ago but it so it will be useful. Or if it possible to save some packets we've forged into a .txt file. Or both.

Anyway thanks again for coding this amazing app ;)

KaitoKito.
[Android Apps and Games] evilsocket:
This is way too specific, i think that only 5% of the users would really use this feature ... i'm sorry but it's not worth implementing it.

This is really cool, but a little bit complex ... pcap is a binary format, not so easy to deserialize in java ( and i don't like the idea of using someone else library ), this is surely gonna be implemented ( i really like the idea ), but don't expect it too soon. ( Could you please open a feature request for this on github so i will remember it ? )

Relatively easy to implement and really nice idea ... what packets would you suggest ( wake on lan is already implemented in the source tree ) ? ^^

BTW Guys, you would do me a favor if instead of posting here ( this thread *should* be used only for support ) your feature requests you'd use the github issue/request tracker because it's easier for me to keep track of requests and remember about them.

Thanks
[Android Apps and Games] KaitoKito:
Maybe doing it on another way ? Like a simple .txt file than we can use as a notepad ?

Others ideas are already on github (although I don't know many useful packets you can add) and in future I will directly post bugs and ideas directly onto it ;)

KaitoKito.
[Android Apps and Games] Fishuu:
Both are on wifi different routers tho

My laptop is on router A while my bro's is on router B witch is connected to router A if that helps
[Android Apps and Games] jonalobo:
it is a really great app..!! testing on captivate with helly bean..! works fine..!!

Edit: can you add something like "usb cleaver" app?

http://xdaforums.com/showthread.php?t=1656497

sorry for my english
[Android Apps and Games] EdgaBimbam:
damn this feature would be cool :D
[Android Apps and Games] :
I was pretty sure I downloaded that one. :confused:

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] el5arsawi:
first of all WOW JUST WOOOW hahaha

well i am not a geek nor a pro but i tried it for fun i dont know the functions but i tried most of them and they all work except for sniffing the password .. i ***ed my friend's laptop lol .. any help with the password sniff

سينت فروم اان ايجيبشن جلاكسي نوت جي تي 7000
[Android Apps and Games] :
Yeah I was definitely already using that version so that's not the issue.

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] evilsocket:
I guess double routers are not supported :(

No, it's something that has almost very nothing to do with dSploit.

What do you do on remote computers during password sniffing ?

I don't think soo, look at the logcat, it's referencing an exception on Hydra.java line 58:

11-09 22:40:20.243 13884 14148 E ACRA : it.evilsocket.dsploit fatal error : Invalid int: "2237248512"
11-09 22:40:20.243 13884 14148 E ACRA : java.lang.NumberFormatException: Invalid int: "2237248512"
11-09 22:40:20.243 13884 14148 E ACRA :	at java.lang.Integer.invalidInt(Integer.java:138)
11-09 22:40:20.243 13884 14148 E ACRA :	at java.lang.Integer.parse(Integer.java:378)
11-09 22:40:20.243 13884 14148 E ACRA :	at java.lang.Integer.parseInt(Integer.java:366)
11-09 22:40:20.243 13884 14148 E ACRA :	at java.lang.Integer.parseInt(Integer.java:332)
11-09 22:40:20.243 13884 14148 E ACRA :	at it.evilsocket.dsploit.tools.Hydra$AttemptReceiver.onNewLine([B]Hydra.java:58[/B])

But, in the latest version, there only a variable declaration on that line https://github.com/evilsocket/dsploit/blob/master/src/it/evilsocket/dsploit/tools/Hydra.java#L58 and the NumberFormatException is handled here https://github.com/evilsocket/dsploit/blob/master/src/it/evilsocket/dsploit/tools/Hydra.java#L66 ... trust me, you are not using the latest version.
[Android Apps and Games] el5arsawi:
well i started sniffing for passwords on my samsung galaxy note and waited for the victim , my friend opened facebook , logged in , and started browsing , opened Y! messenger , logged in and still nothing happened on my password sniffing page , i wonder if i forgot to do something before starting that app ?
[Android Apps and Games] evilsocket:
Facebook seems to have a non standard login, the dissectors are not able to handle it ... try with the hijacker ;)
[Android Apps and Games] :
I installed the latest version for sure. I checked the download and it is definitely the right one.

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] el5arsawi:
haha okay gonna try that , but what my hijacker does is just sniffing, how can i get the passwords from there ? just wondering , this app is really superb haha i couldn't even do that on my laptop before
[Android Apps and Games] evilsocket:
the hijacker sniffs for user sessions and then ( once you click on a session ) allows you to login as that user from your device, without the password but just using his cookies ... you will never know the password, but still you will be able to login as him :)
[Android Apps and Games] blmvxer:
Would it be possible to have a technique that you have people access Facebook, or any other site using your WiFi tether and then you arp-poison and gain access to there account. It would have the same function as droid sheep but you cut the middle man out.
[Android Apps and Games] evilsocket:
no, using dSploit while tethering is not supported at the moment.
[Android Apps and Games] evilsocket:
dSploit 1.0.31b is out!

Changelog:

Implemented debug code profiler to have a clearer logcat when MITM modules slow down the network ( just for user reporting ).

Optimized binary stream search algorithm ( from ~80ms/call to ~13ms/call ).

Fixed #166 : couldn't arp for host x.x.x.x ( or at least the issue is handled ).

Minor code optimizations.

Fixed a bug which could cause javascript corruption during a MITM filtering.

Fixed #164 : "Replace youtube videos with custom ones" issue.

Big optimization of the transparent proxy data streaming performances.

Fixed #163 : Engaged ports when MITM modules are loaded. Fixed an issue occurring when the hijacker was stopped then restarting, causing new sessions not being shown.

Fixed #161 : Faulty nmap, no results returned in trace/portscan/inspector ( thanks to Gerben Meijer )

Switched from ACRA to BugSense bug reporting system ( tnx for BugSense guys for the free plus account!!! )

Fixed #159 : RejectedExecutionException when doing anything.

Fixed #155 : Add a Wake on Lan packets sending function ( to the packet forger module ).

Fixed #156 : Colored services in Login cracker.

Fixed a couple of null pointer exceptions caused by very particular circumstances.

Fixed a race condition when iterating dSploit targets.

Fixed a bug causing the application to crash when the login cracker has too many attempts to try.
[Android Apps and Games] EdgaBimbam:
Great work, just wanted to ask if it is a bug. For example I have started dsploit app and it shows my subnet mask, router and myself on that list. But for example if I will connect my laptop to the same wifi network, list doesnt add that laptop. Refresh button also doesnt find and add new victim. I need to close app and open again to see new victims
[Android Apps and Games] louforgiveno:
Now I can see the open ports ! Thanks for fixing that. :)
[Android Apps and Games] evilsocket:
It's a network device driver issue ... the arp cache it's not always filled even if sending a netbios request to the target ... is this happening all the times you try or just randomly ?

You are welcome :)
[Android Apps and Games] EdgaBimbam:
Need atleast 2 days to test it :) I will try to see what will happen :)

Edit nah, it is fine now :) thx
[Android Apps and Games] :
Update fixed crash but it always gets the wrong password its saying just aaaab or something random.

Sent from my Baconator Over-9000 or my Gmail phone based off iOS based off Android based off Amazon OS based off BlackBerry OS based off Pacman based off Windows 9
[Android Apps and Games] waiters:
When I try to download the new version from your website it sends me to coinurl.com/redirect.php?zone=go&name=dsploit and wants me to to buy bitcoins?
[Android Apps and Games] Cybernerd:
Hi there,

Great app! I'm just wondering if you could add more hack features such as RFID and mobile tracking. Thanks!
[Android Apps and Games] R00T123:
initialisation error

Everytime i start it i get initialisation error how can i fix this i use cm10 on zte skate
[Android Apps and Games] evilsocket:
What is the model of your router/gateway ?

What is the error message in the initialization ? What version of dSploit are you using ?
[Android Apps and Games] evilsocket:
1.0.13b is out!

Changelog:

Now the password sniffer module supports the following protocols:

bgp, cvs, dhcp, dns, ftp, sftp, http, https, icq, imap, imaps, irc, ldap, mountd, msn, mysql,

napster, nbns, nntp, ospf, pop, portmap, radius, rcon, rip, rlogin, smb, smtp, ssmtp, snmp, socks, ssh, telnet, vnc, vrrp, x11, ymsg .

Yes, this is SSL spoofing, kinda cool isn't it ? :D
[Android Apps and Games] waiters:
so far so good, been testing a bit but need to spend more time with it.

can you incorporate droidsheep functionality into this?
[Android Apps and Games] DayDreamin24:
Amazing work.
[Android Apps and Games] R00T123:
I used dsploit 1.0.12b and it tells me only initialisation error nothing else :( edit : with version 1.0.13b the same
[Android Apps and Games] stevie13.xo:
Running this on my thrive and so far so good
[Android Apps and Games] DnaPolymerase:
This is quite good for a beta, I've been playing around a bit and no forcecloses yet. Runs great on the old optimus one.

Thank you for releasing the source code too.

Inviato dal mio LG-P500 usando Tapatalk
[Android Apps and Games] evilsocket:
What you mean exactly ? Which functionality droidsheep has which dsploit doesn't ?

Options -> Settings -> Enable Debug Logging the start the application until you get the message.

You will find the file dsploit-debug-error.log on your sdcard ... please paste me the contents of this file ... if you can't provide me more details about your problem, how am i supposed to fix it ? Then stop complaining about that e start helping me to fix this.

A logcat would be good too.