full-disclosure - MiTM with https there are any tools ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <004f01c64145$d53643d0$96f1fea9@WCG001>
Date: Mon Mar  6 17:45:26 2006
From: wavefront1 at shaw.ca (Rui Pereira (WCG))
Subject: MiTM with https there are any tools ?

Try www.oxid.it instead

Thank You

Rui Pereira,B.Sc.(Hons),CIPS ISP,CISSP,CISA,CWNA
Principal Consultant

WaveFront Consulting Group
Certified Information Systems Security Professionals

wavefront1 <mailto:wavefront1@...w.ca> @shaw.ca | 1 (604) 961 0701

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Brendan
Dolan-Gavitt
Sent: March 6, 2006 8:51 AM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] MiTM with https there are any tools ?

Alehandro Dias wrote:
> Hi,
>
> I need to conduct a test to get the unencrypted https traffic from a
source, 
> but dont know if there are any tools to do that.
> I am able to fake a dns entry, so he thinks i am www.hotmail.com
(example).
>
> There are tools to setup a fake weserver (or proxy) that will redirect the

> queries to the true website, storing the clear data ?
> I imagine ettercap dont help in this situation.

Cain & Abel can also do an SSL man in the middle attack using ARP poisoning
to trick the user into thinking you're the destination server. Very
point-and-click easy to use (though it looks like oxid.it is down at the
moment). Of course, the certs presented to the user will be invalid (unless
you can get them to add you as a trusted CA or something), but there's no
way around that that I know of.

-Brendan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060306/d891a6c3/attachment.html