0

I'm trying intercept my router's ACS requests which are behind HTTPS. I don't think my router validates certificates so it is possible to do a MitM attack. I'm using a debian installed laptop with two ethernet interfaces eth0 and eth1. eth0 is connected to WAN port of the router and eth1 is connected to actual WAN.

I put this into /etc/network/interfaces:

iface br0 inet manual
   bridge_ports eth0 eth1
   up ip link set br0 promisc on arp off up
   down ip link set br0 promisc off down

and executed:

brctl addbr br0
brctl addif br0 eth0 eth1
ifup br0

So far I am able to sniff the communication between my router and ISP but of course I can't see the content of https requests. I don't know where to go from there. I have tried to preroute the traffic coming to https port to 8080 (which burpsuite is listening transparently) with iptables but it didn't work. Actually I don't know how it would work with br0 isn't assigned to an ip address. So if anyone can help me here, I would be grateful.

  • I believe mitmproxy offers a "bridged" mode that allows it to do what you're trying to do. – user Jan 15 at 15:59
  • I couldn't find the "bridged" mode but I tried transparent mode with no luck again. What I'm doing is same as here without configuring ip address for the bridge. But I couldn't manage to get prerouting work. – paddlesteamer Jan 15 at 16:45
  • Yeah that's what it was called, "Transparent Proxy." I used this documentation to set one up for a class project a while ago. – user Jan 15 at 17:16
  • There are lots of unknowns here. It's also possible that your router's firmware has SSL certificates pinned, and that it would take some reverse engineering to force your own certificates onto it. – xorist Jan 16 at 1:34
  • Still, first I want to try MitM attack on TLS connections (which should be easier than reverse engineering) and see if it is applicable or not. If certifcate pinning is the case, then I will go on with reverse engineering. – paddlesteamer Jan 16 at 10:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.