I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/hnc/TR-069_Crash_Course.pdf)
I know the server URL and the fact that it uses a self-signed certificate so I suppose that a MITM with a passive client could be tried.
The goal is to obtain the Voip credentials associated to MY ACCOUNT since my provider does not give them to me.
My hardware is a dual ethernet linux box.
My ideas are:
- Use EBTABLES to manipulate layer 2 traffic and pass all the IN or OUT traffic on given ports and with source/destination IP of the ACS to iptables
- Use IPTABLES to redirect traffic to a MITM SSL proxy and try to see the conversation in cleartext.
- Every example that I find is for a switched network with some sort of NAT/Arp spoofing etc. etc. I just have 2 IP and I learn one of them after PPPoE.
- I want to intercept some kind of traffic and redirect it to my proxy, all other traffic shuld be untouched
A first POC would be to intercept traffic, mark it and log it in iptables anche forward it without notice by client/server, but I still can't figure out how to do it.
Thanks for any help.