2

I did SSLStrip on my network (for educational purpose only!) And I've got the username and all.

system=Test&uid=dixon01&__password=hkulqlyhza&command=login&password=320dd485b1834cf8%7C%40%7C0bf892a5b7dbf901%7C%40%7C5e5f2722f2ed1cc0%7C%28%23%29%7C

The ssl works, the connection with the website is http, but the password is still encrypted? Is the password counted as encryption? Or is it just under some encoding?

  • What's the password supposed to be? I see two password fields, I'm guessing the second one is a hash of the password. – RoraΖ Oct 29 '15 at 18:38
  • I see that uid=dixon01 and password=hkulqlyhza. It is unclear what the purpose of the second password field is. Perhaps they are passing a salt variable? – pr- Oct 29 '15 at 18:53
  • @RoraΖ the password supposed to be b208410480 – Antonio Oct 29 '15 at 19:06
  • @pr user id is fine and correct but the password ?? btw what is salt variable? – Antonio Oct 29 '15 at 19:07
  • Could be some client-side preprocessing of the form data (e.g. encryption). Inspect the JavaScript code of the page that submits this. – JSmyth Oct 29 '15 at 19:22
1

SSLStrip is a transparent proxy that is used to prevent the victim of a MITM attack from uing SSL by clicking on an SSL link. To achieve this SSLStrip replaces all links that start with https:// with http://. The Idea behind this is that most users arent aware of encryption and just use encryption becaue the owner of the webpage links or even redirects them to the secure version of the webpage.

The request you see is clearly not encrypted because you can read it. So this is not a problem of SSLStrip. It is application specific. You can preprocess a password by using javascript. This process can be triggered by clicking the submit button for example. This is done to prevent a sutuation where the pasword travels the wire. It seems like you are in such a situation. Have a look at the webpage with firebug. You can check the button for costum functions triggered when the click event is triggered or the input textfield for costum events when keyup is triggered for example.

  • I do not learn any web programming. i came from networking world. is it necessary to learn web programming language ? – Antonio Oct 29 '15 at 21:17
  • 1
    In forensics it is alway necessary to understand the corpus delicti... – davidb Oct 29 '15 at 21:37
  • Alright .. i will learn some javascript. but before that , and sorry for the newbie question - can you explain to me what each parameter does ? iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080 I passed on the info & man page of ip tables , i get it but not clearly. can you help me with that? – Antonio Oct 29 '15 at 22:13
  • It means that all incoming packets on port 80 are redirected to port 8080 where sslstrip is running – davidb Oct 29 '15 at 22:22
  • Each parameter: -A PREROUTING means that this rule is aplied before the packet is routed -p tcp specifies the protocol,--desctination-port 80 is the port where the packets come in, -j REDIRECT sais that these packets should be redirected and --to-port 8080 specifies the port where they should be redirected to. – davidb Oct 29 '15 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.