Quantcast
Channel: Bountied questions - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 154

Unable to downgrade https to http through sslstrip, arpspoof

$
0
0

I've been following this guide: https://www.cybrary.it/0p3n/using-sslstrip-in-kali-linux/ and others too, ex: official Sslstrip one: https://moxie.org/software/sslstrip/ without any success.

I'm using:

5.2.0-kali2-amd64 #1 SMP Debian 5.2.9-2kali1 (2019-08-22) x86_64 GNU/Linux
sslstrip 0.9 by Moxie Marlinspike

and arpspoof.

I am running first:

echo "1"> /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -p tcp  –destination-port 80 -j REDIRECT –to-port 8080

Then arp spoofing:

arpspoof -i <interface> -t <targetIP> -r <gatewayIP>

Then sslstrip:

sslstrip -w testfile.txt -l 8080 

Then I'm going to my target machine, iPhone running Safari browser. I'm deleting all cache and temp. I'm browsing to non-HSTS preloaded websites (linkedin.com , zsecurity.org ). I'm not specifying https:// , but simply the domain name (ex: linkedin.com). They still load in https.

I tested this multiple times on another client running Windows and Internet Explorer. Same result, I cannot have the target forced to http.

The testsfile.txt from sslstrip is empty. I was expecting the client would open http web-pages.

What am I doing wrong?


Viewing all articles
Browse latest Browse all 154

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>