I am trying to play around to understand how SSLStrip+ works by:

$ cat /proc/sys/net/ipv4/ip_forward
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 9000
$ sudo iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-port 53
$ python sslstrip.py -l 9000 -a log.txt

Then, I prepend as a DNS in /etc/resolve.conf and I configure dns2proxy and fire up:

$ echo ".fakeexample.com" >> domains.cfg
$ sudo python dns2proxy.py -i enp3s0 -u is the target IP (also my own machine running all commands above).

Then, I fire up my browser to hit http://fakeexample.com (fakeexample.com isn't on the HSTS preload list according to hstspreload.org)

I thought sslstrip+ would pick up the traffic from the browser but according to sslstrip+'s log, it doesn't. And the browser states connection refused.

What is missing?

  • Unless you are changing it, iirc it listens on 10000. Also, see serverfault.com/a/211544/235706 Nov 13 '18 at 0:03
  • @multithr3at3d when I started sslstrip, I specified -l 9000, which will make sslstrip+ listens to port 9000 (according to the help page). You mean the victim's browser (my own browser in my case) will go through loopback interface even it sees ip of 192.168.123 instead of I though loopback would be used if the ip is, no?
    – HCSF
    Nov 13 '18 at 1:11
  • the network stack sees that the destination address belongs to the current host, so it never needs to hit the network card Nov 13 '18 at 23:13
  • @multithr3at3d got it. I just tried sudo iptables -t nat -I OUTPUT -p tcp -o lo --dport 80 -j REDIRECT --to-ports 9000. sslstrip+'s log still shows nothing when my browser tries to access fakeexample.com. Not sure what goes wrong.
    – HCSF
    Nov 25 '18 at 7:05
  • I also checked to make sure my box has an interface called lo
    – HCSF
    Nov 25 '18 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.