Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.

For example:
When I receive a request on port 25, I want to be able to intercept all the requests, modify it (e.g. stripping out STARTTLS) and send it to it's destination on port 25.

share|improve this question
    
Do you want to program the filtering part yourself, or are you looking for a tool with builtin filtering rules? –  curiousguy Jun 27 '12 at 22:02
add comment

3 Answers

Look into SSLStrip. It strips off the HTTPS request headers during MITM attack. If web server uses HSTS and browser supports it, then this tool won't be able to strip HTTPS. The code may give you some ideas.

Another option is scapy, which is a packet manipulation program that may be able to do what you are asking.

share|improve this answer
1  
"It does not work with browsers that use HSTS" sslstrip could be used to avoid the HSTS in the first place! –  curiousguy Jun 27 '12 at 22:01
1  
@curiousguy Google Chrome actually hard-codes a list of HSTS sites, so it wouldn't work there with most common sites. Stripping the HSTS header would also only work if it was the first visit to the site. I had thought a while ago about adding that functionality (the source is on github). –  servarevitas3 Jun 28 '12 at 13:08
add comment

Ettercap is pretty good one for Linux.

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

http://ettercap.sourceforge.net/

It's a pretty well known tool, so doing a simple ettercap tutorial google search gives plenty of entry level examples, which will walk you through performing ARP poisoning, intercepting traffic, and then create filters to modify data as it goes through your computer.

share|improve this answer
    
While this may technically answer part of the question, would you care to flesh it out with some more details on the why, and possibly how? –  Scott Pack Jul 6 '12 at 13:30
add comment

I would recommend taking a look at netsed, there is some information on it at http://securitytube-tools.net/index.php?title=NetSed

It allows you to modify contents of traffic going through your machine in realtime through sed style regular expressions.

If you can't get your machine into the flow of traffic through wiring, your could set your machine as the gateway and set its route up to send traffic to the proper location.

If this doesn't work for you could always use something like ettercap, or another tool that would allow you to do some ARP poisoning, effectively making your machine the gateway.

Scapy is very nice as well, as mentioned by servarevitas3.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.