full-disclosure - MiTM with https there are any tools ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <440C4346.2030607@uniontown.com>
Date: Mon Mar  6 15:50:23 2006
From: securitylists at uniontown.com (Security Lists)
Subject: MiTM with https there are any tools ?

You can try DSNIFF  (http://www.monkey.org/~dugsong/dsniff/faq.html) but 
it will present a self-signed cert to the user.

I think you can use Achilles (http://www.digizen-security.com) and not 
even use SSL on the back half and the user might not notice.

-Mark C.

Alehandro Dias wrote:
> Hi,
>
> I need to conduct a test to get the unencrypted https traffic from a source,
> but dont know if there are any tools to do that.
> I am able to fake a dns entry, so he thinks i am www.hotmail.com (example).
>
> There are tools to setup a fake weserver (or proxy) that will redirect the
> queries to the true website, storing the clear data ?
> I imagine ettercap dont help in this situation.
>
> Thnx
>
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/