0

As the title says, does anybody know how Subterfuge bypasses the SSL layer?

closed as unclear what you're asking by GdD, TildalWave, Xander, AJ Henderson, Iszi Apr 4 '14 at 15:05

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

0

Subterfuge is a Man-In-The-Middle tool kit that allows you to intercept communication on a LAN. Generally this is done by ARP Poisoning, tricking the client into thinking your IP is the destination. From there the attacker could steal credentials, inject malicious code, or change data.

The tool does incorporate sslstrip, which is a tool that replaces all https:// instances in a website with http://. This would bypass SSL from the client to the attacker, and then relay the data to the destination server via SSL.

Client ->[plaintext]-> MITM ->[SSL]-> Destination

This only works if the original webpage was using http:// and then linked to https:// either via a hyperlink or a form. If the client tries to make a direct connection to the server using SSL (i.e: from bookmark), then you would not be able to force them into plaintext.

Not the answer you're looking for? Browse other questions tagged or ask your own question.