1

I'm trying to make sslstrip work with Internet Connection Sharing.ve shared internet connection to router and another pc connected to that router, all are Linux, so

Internet <-> pc1 <-> broadband router <-> pc2

How can I use pc1 to decrypt all ssl packet coming from pc2 with ssl strip

Improve this question
  • 1
    Please don't cross post on Stack Exchange. If your question is not in the appropriate site then please wait for it to be migrated. – DKNUCKLES Apr 18 '12 at 20:39
  • 1
    Is your question about how to see the traffic? If so, does this answer give you the info you need? security.stackexchange.com/a/13939/485 – Rory Alsop♦ Apr 19 '12 at 10:49
  • Thanks Rory, My question is how to see the ssl encrypted traffic in the scenario described above ? – Jack J. Apr 19 '12 at 22:33
2

Fundamentally, sslstrip acts as a transparent proxy for web traffic that changes https:// to http://. The transparent proxy functionality is implemented using ARP spoofing, which means the network switch needs to be susceptible to ARP spoofing attempts.

So you'd install sslstrip on pc1, make sure pc1 is able to forward packets, start arpspoof (separate package than sslstrip - i think arpspoof is on SF), and run sslstrip. You can see if arpspoof is running by running tcpdump on pc1 or checking the mac address table on the broadband router - the internet router should list the MAC address of pc1 and tcpdump should show all packets routing from pc2.

Aside from that, moxie's defcon prezo is published here. There's also videos that show you how to make this work link

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.