Full Disclosure mailing list archives
RE: MiTM with https there are any tools ?
From: "Rui Pereira (WCG)" <wavefront1 () shaw ca>
Date: Mon, 06 Mar 2006 09:46:00 -0800
Try www.oxid.it instead Thank You Rui Pereira,B.Sc.(Hons),CIPS ISP,CISSP,CISA,CWNA Principal Consultant WaveFront Consulting Group Certified Information Systems Security Professionals wavefront1 <mailto:wavefront1 () shaw ca> @shaw.ca | 1 (604) 961 0701 -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Brendan Dolan-Gavitt Sent: March 6, 2006 8:51 AM To: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] MiTM with https there are any tools ? Alehandro Dias wrote:
Hi, I need to conduct a test to get the unencrypted https traffic from a
source,
but dont know if there are any tools to do that. I am able to fake a dns entry, so he thinks i am www.hotmail.com
(example).
There are tools to setup a fake weserver (or proxy) that will redirect the
queries to the true website, storing the clear data ? I imagine ettercap dont help in this situation.
Cain & Abel can also do an SSL man in the middle attack using ARP poisoning to trick the user into thinking you're the destination server. Very point-and-click easy to use (though it looks like oxid.it is down at the moment). Of course, the certs presented to the user will be invalid (unless you can get them to add you as a trusted CA or something), but there's no way around that that I know of. -Brendan
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MiTM with https there are any tools ? Alehandro Dias (Mar 06)
- Re: MiTM with https there are any tools ? Vincent Archer (Mar 06)
- Re: MiTM with https there are any tools ? Rik Bobbaers (Mar 06)
- Re: MiTM with https there are any tools ? Dave Aitel (Mar 06)
- Re: MiTM with https there are any tools ? Mark Coleman (Mar 06)
- Re: MiTM with https there are any tools ? Security Lists (Mar 06)
- Re: MiTM with https there are any tools ? Brendan Dolan-Gavitt (Mar 06)
- RE: MiTM with https there are any tools ? Rui Pereira (WCG) (Mar 06)
- Re: MiTM with https there are any tools ? Brendan Dolan-Gavitt (Mar 06)
- Re: MiTM with https there are any tools ? Francisco Amato (Mar 06)
- Re: MiTM with https there are any tools ? Claes Nyberg (Mar 07)
- Re: MiTM with https there are any tools ? Fósforo (Mar 08)
- Re: MiTM with https there are any tools ? Vincent Archer (Mar 06)