MITMf/sslstrip at v0.8 - MITMf - gitea.threefifteen.info

github/MITMf

mirror of https://github.com/byt3bl33d3r/MITMf.git synced 2025-03-12 04:35:49 -07:00

History

byt3bl33d3r 9f4ddc5894 merged changes from dev

2014-11-29 18:17:56 +01:00

..

__init__.py

initial commit

2014-07-07 13:40:49 +02:00

ClientRequest.py

fixed minor bug

2014-11-29 17:37:42 +01:00

ClientRequestHSTS.py

merged changes from dev

2014-11-29 18:17:56 +01:00

CookieCleaner.py

initial commit

2014-07-07 13:40:49 +02:00

COPYING.sslstrip

initial commit

2014-07-07 13:40:49 +02:00

DnsCache.py

initial commit

2014-07-07 13:40:49 +02:00

DummyResponseTamperer.py

initial commit

2014-07-07 13:40:49 +02:00

ProxyPlugins.py

initial commit

2014-07-07 13:40:49 +02:00

README.AppCachePoison

moved readme

2014-07-24 20:41:13 +02:00

README.sergio-proxy

initial commit

2014-07-07 13:40:49 +02:00

README.sslstrip

initial commit

2014-07-07 13:40:49 +02:00

README.sslstrip+

added HSTS bypass as demonstrated by Leonardo Nve at blackhat

2014-10-11 13:09:06 +02:00

ResponseTampererFactory.py

fixed debug logging output

2014-07-14 09:10:45 +02:00

ServerConnection.py

merged changes from dev

2014-11-29 18:17:56 +01:00

ServerConnectionFactory.py

added PoC session hijacking plugin

2014-11-26 20:01:28 +01:00

ServerConnectionHSTS.py

misc

2014-11-29 17:12:21 +01:00

SSLServerConnection.py

initial commit

2014-07-07 13:40:49 +02:00

SSLServerConnectionHSTS.py

added HSTS bypass as demonstrated by Leonardo Nve at blackhat

2014-10-11 13:09:06 +02:00

StrippingProxy.py

session hijack plugin 50% done

2014-11-28 23:37:11 +01:00

StrippingProxyHSTS.py

added HSTS bypass as demonstrated by Leonardo Nve at blackhat

2014-10-11 13:09:06 +02:00

URLMonitor.py

session hijacker plugin complete

2014-11-29 15:30:43 +01:00

URLMonitorHSTS.py

added PoC session hijacking plugin

2014-11-26 20:01:28 +01:00

README.sslstrip+

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

SSLStrip+
=========

This is a new version of [Moxie´s SSLstrip] (http://www.thoughtcrime.org/software/sslstrip/) with the new feature to avoid HTTP Strict Transport Security (HSTS) protection mechanism.  
  
This version changes HTTPS to HTTP as the original one plus the hostname at html code to avoid HSTS. Check my slides at BlackHat ASIA 2014 [OFFENSIVE: EXPLOITING DNS SERVERS CHANGES] (http://www.slideshare.net/Fatuo__/offensive-exploiting-dns-servers-changes-blackhat-asia-2014) for more information.  
  
For this to work you also need a DNS server that reverse the changes made by the proxy, you can find it at https://github.com/LeonardoNve/dns2proxy.


Demo video at: http://www.youtube.com/watch?v=uGBjxfizy48