mitm

[SomeUser]

There is a computer with two interfaces I try to insert it in the middle of the line (try to implement MITM),
such as one interface it looks at the router and the other to look at another computer.

Code: [Select]

iptables --flush
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
brctl addbr bridge0
brctl addif bridge0 eth0
brctl addif bridge0 eth1
ifconfig bridge0 192.168.0.199 up

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -i bridge0 -p tcp --destination-port 80 -j REDIRECT --to-ports 8080
cd /pentest/web/sslstrip
perl sslstrip.py -l 8080
then I try to:

Code: [Select]

ettercap -Tq -i bridge0
But nothing happens(in the terminal where I ettercap run empty)
I need to implement prompt ARP spoofing or not? or not ..
because all traffic running through my bridge0 interface, I will be very grateful for the help.

[proxx]

Not that SSLstrip is very usefull these days.
But yes indeed, the client and the gateway (presuming there is any) will know each other because of the ARP table.
Both will do a broadcast saying who they are and will actively look who has IP address x.x.x.x.
The gateway for example will reply and say that IP address is at FF:FF:FF:FF:FF ,the gateway will then make an entry in its ARP table with the MAC address and IP address of the client.
Same goes the other way around.
So if you have that little bridge of yours (which works like a switch) you would need some way confusing the devices.
Basically lying about your IP address and have them send traffic to you instead.
Since you let this traffic through, neither side will be aware of any such thing going on.

Be aware that if you ARP poison the devices you have to make sure that you send out the correct MAC address for their table since you are using more than one interface.
Easiest way to do this is have 2 instances of ARPspoof running each for 1 interface.
Makes sense?

[SomeUser]

ettercap -Tq -i bridge0 -M arp -L log // //


?

[proxx]

ettercap -Tq -i bridge0 -M arp -L log // //


?

I think this is rather rude.
You cp some shit from some website, you ask a question , I am nice enough to explain to you some fundamentals and all you reply with is this.
I get the feeling you dont give a shit about how it works you just want to "hack" someone, gl.

[SomeUser]

Look smart!! I understand how and what works here! This example works with all open protocols(Problem was with another computer)! I need to make it work with SSL, explains how this type of attack is not necessary.!