I am trying to play around to understand how SSLStrip+ works by:

$ cat /proc/sys/net/ipv4/ip_forward
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 9000
$ sudo iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-port 53
$ python sslstrip.py -l 9000 -a log.txt

Then, I prepend as a DNS in /etc/resolve.conf and I configure dns2proxy and fire up:

$ echo ".fakeexample.com" >> domains.cfg
$ sudo python dns2proxy.py -i enp3s0 -u is the target IP (also my own machine running all commands above).

Then, I fire up my browser to hit http://fakeexample.com (fakeexample.com isn't on the HSTS preload list according to hstspreload.org)

I thought sslstrip+ would pick up the traffic from the browser but according to sslstrip+'s log, it doesn't. And the browser states connection refused.

What is missing?

  • Unless you are changing it, iirc it listens on 10000. Also, see serverfault.com/a/211544/235706 Commented Nov 13, 2018 at 0:03
  • @multithr3at3d when I started sslstrip, I specified -l 9000, which will make sslstrip+ listens to port 9000 (according to the help page). You mean the victim's browser (my own browser in my case) will go through loopback interface even it sees ip of 192.168.123 instead of I though loopback would be used if the ip is, no?
    – HCSF
    Commented Nov 13, 2018 at 1:11
  • the network stack sees that the destination address belongs to the current host, so it never needs to hit the network card Commented Nov 13, 2018 at 23:13
  • @multithr3at3d got it. I just tried sudo iptables -t nat -I OUTPUT -p tcp -o lo --dport 80 -j REDIRECT --to-ports 9000. sslstrip+'s log still shows nothing when my browser tries to access fakeexample.com. Not sure what goes wrong.
    – HCSF
    Commented Nov 25, 2018 at 7:05
  • I also checked to make sure my box has an interface called lo
    – HCSF
    Commented Nov 25, 2018 at 7:06


You must log in to answer this question.

Browse other questions tagged .