3

I am trying to play around to understand how SSLStrip+ works by:

$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 9000
$ sudo iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-port 53
$ python sslstrip.py -l 9000 -a log.txt

Then, I prepend 127.0.0.1 as a DNS in /etc/resolve.conf and I configure dns2proxy and fire up:

$ echo ".fakeexample.com 192.168.1.123" >> domains.cfg
$ sudo python dns2proxy.py -i enp3s0 -u 192.168.1.123

192.168.1.123 is the target IP (also my own machine running all commands above).

Then, I fire up my browser to hit http://fakeexample.com (fakeexample.com isn't on the HSTS preload list according to hstspreload.org)

I thought sslstrip+ would pick up the traffic from the browser but according to sslstrip+'s log, it doesn't. And the browser states connection refused.

What is missing?

  • Unless you are changing it, iirc it listens on 10000. Also, see serverfault.com/a/211544/235706 – multithr3at3d Nov 13 '18 at 0:03
  • @multithr3at3d when I started sslstrip, I specified -l 9000, which will make sslstrip+ listens to port 9000 (according to the help page). You mean the victim's browser (my own browser in my case) will go through loopback interface even it sees ip of 192.168.123 instead of 127.0.0.1? I though loopback would be used if the ip is 127.0.0.1, no? – HCSF Nov 13 '18 at 1:11
  • the network stack sees that the destination address belongs to the current host, so it never needs to hit the network card – multithr3at3d Nov 13 '18 at 23:13
  • @multithr3at3d got it. I just tried sudo iptables -t nat -I OUTPUT -p tcp -o lo --dport 80 -j REDIRECT --to-ports 9000. sslstrip+'s log still shows nothing when my browser tries to access fakeexample.com. Not sure what goes wrong. – HCSF Nov 25 '18 at 7:05
  • I also checked to make sure my box has an interface called lo – HCSF Nov 25 '18 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.