0

I am developing a security information lab.

My Kali notebook is connected to my regular wifi (this is my Internet source) and the eth0 is connected in the LAN interface of a wireless router (this is the Victim's Wifi).

The wireless router's DHCP is disabled, I've configured the Kali DNSMASQ to distribute the IP configuration.

When someone connects to this wireless network, it will get an IP and use Kali as the default gateway to browse the web, since I use a proxy like Burp, Squid, or enable the IPV4 Forwarding + Masquerade.

Now I want to do a MITM attack to decrypt HTTPS traffic.

I was trying to use SSLStrip Plus, Bettercap, MITM Proxy, and I am not able to get the traffic without changing the SSL certificate or doing spoofing.

Since I control the default gateway, is there a better way to do the MITM without changing the victim's browser?

3

No, if you are trying to decrypt websites like facebook, google+, twitter, etc... for login credentials, it will not work. HTTP-SSL/TLS (HTTPS) will encrypt the traffic. All sslstrip does is redirect pages to non-HTTPS versions. So https://www.website.com becomes http://www.website.com. Of course this is very simplified but in turn the end result is un-encrypted traffic. It does not decrypt it. Then HSTS was created to stop this, only HTTPS pages were allowed for said sites. What SSLStrip+ does is redirect to a sub-domain without the HSTS header. For example wwww.facebook.com, then HTTP is allowed. But it works with very few sites because of the AllowSubDomains=True part of the header. This meand wwww.facebook.com is resolved to the DNS IP of regular www.facebook so data is still encrypted. Sorry. If you want I recommend just DNS spoofing non HSTS sites but asking for GOOGLE+ data to continue from your own APACHE server. (If you are on the same LAN) Then you get it anyway, but it is much easier.

Very unlikely.

Or, if you have enough control, theoretically you could install a root CA so your SSL/TLS certificate is trusted. But if you have that much control why not just use a key-logger.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.