As the title says, does anybody know how Subterfuge bypasses the SSL layer?
closed as unclear what you're asking by GdD, TildalWave, Xander, AJ Henderson, Iszi Apr 4 '14 at 15:05
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Subterfuge is a Man-In-The-Middle tool kit that allows you to intercept communication on a LAN. Generally this is done by ARP Poisoning, tricking the client into thinking your IP is the destination. From there the attacker could steal credentials, inject malicious code, or change data.
The tool does incorporate sslstrip, which is a tool that replaces all
https:// instances in a website with
http://. This would bypass SSL from the client to the attacker, and then relay the data to the destination server via SSL.
Client ->[plaintext]-> MITM ->[SSL]-> Destination
This only works if the original webpage was using
http:// and then linked to
https:// either via a hyperlink or a form. If the client tries to make a direct connection to the server using SSL (i.e: from bookmark), then you would not be able to force them into plaintext.