I have successfully performed a MITM attack and have managed to view the HTTP/HTTPS packets of the victim passing through the nat table of the PREROUTING chain of my iptables.(using -j LOG) However, why am I not able to see Skype traffic from the victim in the nat table of the PREROUTING chain as well? The Skype traffic appears normally in the raw and mangle table but somehow 'disappears' from the nat table. I have already enabled ip forwarding. Any possibilities for this weird behavior? The Skype traffic is simply just TCP encrypted with TLS.

  • Does skype still connect through TCP+TLS when you use interception? I'd expect a TLS handshake failure when the TLS connection gets attacked like that (which might induce skype to switch to a different transport, like UDP). – CodesInChaos May 5 '17 at 17:52
  • Yup wireshark still sees the traffic as TCP+TLS even when MITM is in place – Lew Wei Hao May 5 '17 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.