How does SSLStrip grab traffic?

Question

In Marlinspike's description on how to set up SSLStrip, he says to enable forwarding

echo "1" > /proc/sys/net/ipv4/ip_forward

then redirect traffic from port 80 to the SSLStrip listen port

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port <listenPort>

and then to poison ARP to get traffic sent to this host

arpspoof -i <interface> -t <targetIP> <gatewayIP>

(See http://www.thoughtcrime.org/software/sslstrip/)

I don't get it. I understand that using arpspoof gets other machines to believe your host is the gateway, but then iptables will look at TCP/IP packets with destination port 80 and rewrite them to have a new port in the TCP header. But the IP address isn't changed, correct? So the attacker will forward to the dest IP address with a new port, and SSLStrip will never seen the packet.

Does iptables by default change the IP address as well?

Answer 1

The REDIRECT target in iptables will rewrite the destination ip to the local ip on the incoming interface. The port will per default remain the same, by you can rewrite it using --to-port.

Extra: to redirect to a different IP, you can use the DNAT target instead using -j DNAT --to <ip>:<port>