I am trying to use SSLstrip tool with Ettercap on Kali Linux to attack my personal bank account and yahoo account for testing purposes.
I followed the instructions of this video (I run it on Kali Linux not on Backtrack5) and I was able to sniff many websites credentials of mine.
However, I have encountered the following problems:
Websites that have strict transport security (HSTS) enabled (like YAHOO Mail) has resisted the attack. Any work around? (How to perform SSLstrip attack on HSTS enabled web portals?)
My bank web portal does not have HSTS enabled as indicated by SSLlabs. So I was able to login to my bank account over an SSLstrip connection. The google chrome address bar was showing a red cross mark (x) to indicate the false SSL certificate used over SSLstrip connection. This indicate that the attack was successful, however, Ettercap tool did not show the entered username and password on my bank login web portal !!! Any idea about how they were able to protect the credentials from being displayed over an SSLstrip connection?
You can check it by just trying to provide your personal web banking credentials via an SSLstrip connection established through a virtual machine on your personal computer. You will realize that everything goes smoothly as if the attack was successful but the Ettercap tool won't display the credentials information of your bank account as what it does for other websites. I tested various bank portals including bankofamerica and I have discovered that all of them does not support HSTS but Ettercap tool won't display the entered credentials for any of them for unknown reason.