MITM: sslstrip + mitmdump

Question

I'm doing some MITM injection with mitmdump (mitmproxy):

 mitmdump -s 'injection.py' -m transparent

it works perfectly (over HTTP) as intended.

Then I heard of SSLstrip :

sslstrip -l 8080

which works as intended as well.

But I don't understand how to do my "own injection" (injection.py) + SSLstrip.

Running mitmdump after SSLstrip or vice versa tells me that 8080 is already in use.

Error starting proxy server: OSError(98, 'Address already in use')

How to combine SSLstrip + mitmdump? How to run an external injection script (injection.py) + SSLstrip? Is there an other/better way?

You can replicate most of sslstrip's functionality using one of the example scripts included with mitmproxy: github.com/mitmproxy/mitmproxy/blob/master/examples/complex/… Your custom injection logic could be added to this file. — multithr3at3d, Commented Apr 16, 2018 at 15:02

multithr3at3d · Accepted Answer · 2018-04-16 16:06:23Z

0

You can replicate SSLStrip's functionality using a Mitmproxy script. In the examples directory of the Mitmproxy source tree, see sslstrip.py.

You can simply modify the request or response functions in this script to perform the custom injection that your own script does.

answered Apr 16, 2018 at 16:06

multithr3at3d

13.2k3 gold badges34 silver badges45 bronze badges

Add a comment |

1 Answer 1