-2

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want real solutions, commands, action.

This is what I do the moment:

arpspoof -i eth0 -t <target> <router>

dnsspoof -i eth0 -f hosts

and this is my hosts file:

<myip> *.*.*
<myip> *.*
<myip> *.*.*.*

I am running apache server, so the victim is redirected to a my index.html page, but only HTTP can.

  • 5
    You understand that HTTPS is there to prevent this right? You'll can only get answers telling you to try sslstrip (HSTS?), generating an (invalid) certificate and getting the user to accept it, masquerade as the owner of the server you're trying to impersonate and ask for a valid cert, or compromise a real CA and sign yourself a valid cert (HPKP?). If someone has a real/simple solution to this, he would have broke TLS and most likely wouldn't burn his exploit on stackoverflow. – northox Oct 15 '15 at 16:16
  • 2
    "Don't tell me that I have to generate a certificate or send a legitimate certificate, I want real solutions, commands, action." ?? You seem to already have an idea about a solution. – schroeder Oct 15 '15 at 16:56
  • @northox I have tried with sslstrip, but apparently it doesn't work, maybe because HSTS. There is a way to break HSTS, using time synchronization attacks, going to a "future time" where the HSTS time expires, with the NTP protocol, but I think there must be a simpler way. – aDoN Oct 19 '15 at 10:11
1

You can spoof DNS using DNSchef for example. Before you can start you have to configure your netfilter module correctly by iptables to accept DNS requests and to redirect them to your host impartial from the destination ip.

iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53

Then start DNSChef

dnschef --fakeip <your ip> --fakedomains google.com

This would redirect all traffic of google.com and all subdomains to your ip.

But this wont get you around HTTPS in any case. When the user explicitly types https://www.google.de for exapmle the request will come in at your fakeip but it will expect SSL anyway. Then you need a certificate anyhow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.