Show Posts
1
Hacking and Security / Re: Ettercap kills connectivity of victim.
« on: January 21, 2015, 08:45:18 PM »
Apparently ettercaps iptable in etter.conf seem not to work. At least they are the reason why the victims url requests time out.
I even commented out those two iptable lines and made my own iptable in a separate terminal using:
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
Unfortunately the requests from the victim time out again.
Update: iptables seem not to be the problem. When I first ran ettercap on my fresh installed kali eeepc sslstrip didn't work on mail.yahoo and facebook (I used random usernames and passwords) though both sites were loading.
I totally forgot to set ettercap to root and enable iptables inside etter.conf.
Now I believe the arp poisoning is the problem since I reset etterconf to default and my MBP cant load websites again.
Update:
Kalis /proc/sys/net/ipv4/conf/all/arp_accept is off by default so arp spoofing a Kali machine is unlikely to be successful.
I noticed that most big sites use HSTS to protect them self against sslstrip.
And other sites don't offer a http:// anymore and browser tend to spit out several warnings as soon as they detect sslstrip's self-signed certificates.
My conclusion is ettercap + sslstrip are pretty much dead. Correct me if I'm wrong.
An easier method is a rogue AP/evil-twin + dns spoofing.
P.s.: English is not my native language so please tell me my mistakes so I can wipe them out
I even commented out those two iptable lines and made my own iptable in a separate terminal using:
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
Unfortunately the requests from the victim time out again.
Update: iptables seem not to be the problem. When I first ran ettercap on my fresh installed kali eeepc sslstrip didn't work on mail.yahoo and facebook (I used random usernames and passwords) though both sites were loading.
I totally forgot to set ettercap to root and enable iptables inside etter.conf.
Now I believe the arp poisoning is the problem since I reset etterconf to default and my MBP cant load websites again.
Update:
Kalis /proc/sys/net/ipv4/conf/all/arp_accept is off by default so arp spoofing a Kali machine is unlikely to be successful.
I noticed that most big sites use HSTS to protect them self against sslstrip.
And other sites don't offer a http:// anymore and browser tend to spit out several warnings as soon as they detect sslstrip's self-signed certificates.
My conclusion is ettercap + sslstrip are pretty much dead. Correct me if I'm wrong.
An easier method is a rogue AP/evil-twin + dns spoofing.
P.s.: English is not my native language so please tell me my mistakes so I can wipe them out