Jump to content

Search the Community

Showing results for tags 'MITM'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


  • Talk
    • Everything Else
    • Gaming
    • Questions
    • Business and Enterprise IT
    • Security
    • Hacks & Mods
    • Applications & Coding
    • Trading Post
  • Hak5 Gear
    • Hak5 Cloud C²
    • WiFi Pineapple Mark VII
    • USB Rubber Ducky
    • Bash Bunny
    • Key Croc
    • Packet Squirrel
    • Shark Jack
    • Signal Owl
    • LAN Turtle
    • Screen Crab
    • Plunder Bug
  • O.MG (Mischief Gadgets)
    • O.MG Cable
    • O.MG DemonSeed EDU
  • WiFi Pineapple (previous generations)
    • WiFi Pineapple TETRA
    • WiFi Pineapple NANO
    • WiFi Pineapple Mark V
    • WiFi Pineapple Mark IV
    • Pineapple Modules
    • WiFi Pineapples Mark I, II, III
  • Hak5 Shows
  • Community
    • Forums and Wiki
    • #Hak5
  • Projects
    • SDR - Software Defined Radio
    • Community Projects
    • Interceptor
    • USB Hacks
    • USB Multipass
    • Pandora Timeshifting

Find results in...

Find results that contain...

Date Created

  • Start


Last Updated

  • Start


Filter by number of...


  • Start





Website URL







Enter a five letter word.

  1. Hello, I've been attempting to redirect port 80 to port 8080 using iptables v1.8.3 to test an SSL strip MITM attack. I've entered the command: iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080 upon entering it gives me the _error_: unknown option "--dport" it also doesn't recognize the "--to-port" option. I'm running Kali Linux on a Rasberry Pi 4B 4GB Does anyone know how I can resolve this? I haven't found anything useful on the web after three days of troubleshooting. cheers! -MichaelPV
  2. I have a payload idea for the packetsquirrel. The idea is to use the bashbunny or the rubberducky to install a certificate in a victims computer. Then deploy the packet squirrel to be able to decrypt all https traffic. I'm just wondering two things, first, does anybody know any decent mitm program that the packet squirrel can actually run? I have looked at bettercap but it runs on ruby so I'm unsure if it will work with the packet squirrel. I have also looked a bit into mitmproxy but I found the documentation vague. If it can't be run the packet squirrel, maybe you could connect
  3. Hi, I have a WiFi Pineapple Nano which I recently purchased with the intention of testing the following: Scenario: smart devices and a smart phone within a home environment, with apps on the smartphone used to manage these devices. All connected to GuestWiFi WLAN. I have a HomeWiFi WLAN which I connected my laptop and other computing devices too. Both WLANs use the same power line home extender service (TPLink) I wish to: 1) Use the Nano to sniff traffic on the GuestWiFi WLAN 2) Perform a MiTM by either creating a PineappleWiFi SSID and force all devices to con
  4. What is the best way to protect me against MITM attacks under a public network?
  5. Hello , i bought new Wifi Pineapple NANO and i i've tried to install Ettercap module but i can not run it , and there is no log to check what is going on . is there any way to apply MITM attack on public network without forcing the clients to connect to my own evil AP , i want to spoof ARP and tcpdump all the traffic in nano sd. Thanks
  6. Hi, I don't post a lot on this forums but I made a cool script that protects a linux box from gateway ARP Poisoning attacks (it does it instantly, without a 5 second poll delay like other scripts). All details are on the github repo: https://github.com/Prodicode/ARPPD All feedback is appriciated! This was my first security project in C.
  7. Hey Guys, with April fools coming up soon I want to try to make an nCage payload for the LanTurtle. For the uninitiated, "nCage" is a Chrome extension that replaces every picture in the web browser with a picture of Nick Cage. I swear I saw somewhere that there was a payload for the LanTurtle that replaced pictures in the browser with pictures of cats, so I figured I could modify that payload, but I couldn't find it. Is anyone familiar with a payload similar to that?
  8. Im having problems if my SSLsplit v1.1, it's unstable, i click start, but it don't start, or starts but immediately stops, or stop the internet connect. Any idea what i can do?
  9. ok so ive setup the nano with wp6 to share connection with kali, this all works spot on, then i connect to the nano with my phone, this is also fine, i fire up wireshark but only see traffic directed from, is this correct, i persumed i would be seeing the given IP from my phone? should the internet connection be coming from the nano or the laptop? what interface should i be sniffing? this is slightly baffling my brain but i know its so simple, to much eggnog i think, I know in a moment this will just click in my brain as i feel im putting way to much thought in
  10. Hey guys, I've ran into a bit of trouble, could some kind soul help me out please? I'm unable to access POST and GET variables from within the landing page's php if there is a path specified in the URL that isn't "index.php" Example landing page code below, var_dump($_POST) on line 12 returns an empty array despite the form sending the data: <?php if(!strstr($_SERVER['HTTP_HOST'],"twitter") && !strstr($_SERVER['HTTP_HOST'],"twimg") ) { /* If not visiting twitter, redirect to non-HSTS twitter domain */ die('<meta http-equiv="refresh" content="0; url=http://twitter.co.uk/"
  11. Hi everyone, I use the Wi-Fi pineapple as a man in the middle Device Redirecting all traffic to a Laptop That the Wi-Fi pineapple is tethered to, Similar to this setup: https://www.evilsocket.net/2016/09/15/WiFi-Pineapple-NANO-OS-X-and-BetterCap-setup/ So here's my setup, MacBook running linux VM (Virtual box) Connected via USB To the Wi-Fi pineapple That's sending all traffic To the virtual box Machine : Pardon my diagram skills :( Here describe that I have created Based off of the post Above, HoweverI don't think this is ideal since you would need to ssh into the pi
  12. Hello, I hope my video will help you understand how hackers can man in the middle attack and one of their tools they can use. Look what they can do with Xerosploit.
  13. KST


    Hi I test the ssh mitm by the way this link. I have three PC ;attacker PC,ssh server and ssh client.After all instruction are made, I connect ssh to server from client .But when I do this , I cannot login with user from server. I can only login with attacker 's username and password and get logined to attacker pc.It means that attacker pc doesnot redirect to ssh server. But I have completed all instructions described in that link. If you have time, please check my question and answer me.
  14. Hi Everyone! I am trying to achieve this scenario : connect client to management AP, gets IP address from pineapple. PC on same pine network has same subnet address of I want to be able to forward all traffic from the client device onto the PC which is running burpsuite. I have tried almost every thread that i can find and whatever i do i cannot get this traffic from the device through burpsuite. is it actually possible to do this? as in a client connects to the pineapple network and then the traffic is passed through to burpsuite? My set up in bur
  15. After using MITMf for a while on my Kali Linux machine, I'm wondering whether it would be feasible to use it on a Bash Bunny. You'd have to be able to pull things like the gateway and DNS server automatically, but beyond that the only problem I can think of is the complex dependencies for MITMf. Thoughts?
  16. I'm trying to perform a javascript injection with ettercap 0.8.2 and its filter, but it did not work. All the relevant topics I found are before 2016, I am not sure if this kind of attack still works now? Anyway, this is my filter script if (ip.proto == TCP && tcp.dst == 80) { if (search(DATA.data, "Accept-Encoding")) { replace("Accept-Encoding", "Accept-Nothing!"); msg("zapped Accept-Encoding!\n"); } } if (ip.proto == TCP && tcp.dst == 80) { if (search(DATA.data, "<head>")) { replace("<head>", "<HEAD>"); msg("Code injected"); } } And I run it as e
  17. Hello Hak5 members, New to this site and platform, but am pretty excited to be back in the states and to get my hands on the Tetra I purchased. When looking at modules I can't seem to find something similar to the MITMf framework integrated into it. This takes use of filepwn, but I have been having a great experience using Shellter. Where should I go for learning how to integrate a new module into the Pineapple? Here is what I am wanting: 1. Client makes request for .exe file 2. Pineapple forwards to the web server 3. Web server responds 4. Pineapple receives the
  18. Hey all, The Tetra allows us to do so many great things. We can spoof the SSID and make a Client think they are connecting to a "known" AP. The Client has the WPA2 password stored to automatically connect to its "known" AP. Why can't we spoof the SSID (and MAC if necessary) but also prompt for a passkey (WEP/WPA/WPA2 depending on the legitimate AP) and sniff the passkey that the Client sends? I have a feeling the issue has to do with hashing done at each sides of the 4-way handshake. It just seems like we should be able to MitM some of this. Appreciate anyones input
  19. Hi guys! I recently wanted to get interrested in deploying a MITM attack in my home network. I firstly used SSLSplit and ettercap from the Pineapple Web Interface (which is a little bit buggy sometimes). From there, the attack worked 1/3 of the time. Then I tried to do this from the CLI. ettercap seems to work pretty well (ettercap -Tqi wlan1 -M arp:remote // //) but I didn't managed to get SSLStrip working... And if I try to run SSLStrip from the GUI, the certs are signed by "SSLStrip", which cause security warnings. Is there a way to generate customs certs and pass them to the
  20. Hallo, I have one question about the Lan Turtle. When i connect the Lan turtle in a PC from a "big" network so the lan turtle has acces to the network, doesnt it? When i want to start a MITM attack, have the target device only be in the same network or should i connect the lan turtle directly to the targetet device? So for example i plug in the lan turtle in "PC206" and i want to attack the "PC259" does it works or should i plug in the turtle in PC259? I Hope you understand my question :) Thanks in advice, Simon PS: sorry for my bad
  21. Hello, I was wondering what are the different techniques you guys use for a man in the middle attack. Just for something to learn and advance on. Thanks.
  22. Is there any possible ways of doing MITM attacks that would take usernames and passwords. When I try to use Xerosploit, PytheM, or even bettercap. None of these methods work on websites such as Facebook, Twitter, Paypal, Gmail, etc. Is there any new methods that is the latest that is working right now?
  23. Hi, I did a pentest in a LAN, some weird things happened. This LAN is a little unusual, there are two routers, say A and B, A is directly connected to an optical fiber, doing PPPoE, to the WAN, it has a gateway of, B is connected to A, wireless router, with a gateway of All the clients and my Kali machine are connected to B. Target has an IP of Here is what I did with Kali, I use the following to arp spoof the target and router B arpsoof -i eth0 -t arpsoof -i eth0 -t sysctl -w ne
  24. Hey guys, I'm partially new here, just wanted a little bit of help with MiTM attack. Suppose, I successfully cracked my Neighbours WiFi using Evil Twin method and now I want to Man In Middle his smart phone or his whole network, is it possible? My question here is that most of us nowadays use smart phones to use Facebook, E-mails etc and not just go to browser and then facebook.com right? So is that possible? Thanks! :confused:
  25. I am completely and utterly disappointed. i have been searching for weeks to find out how to preform a arp-poising MITM attack to sniff plain text credentials, the best thing i could find was Responder. There is no guide on how to use this explicitly on the WiFi Pineapple. I have basically paid $250 for a box. The last person to ask about this did not get anywhere in terms of help either. Please Can somebody in this entire forum show me how i can configure Responder to work on a Wireless network. Like from the ground level. What options do i select, do i connect in client mode (Wlan1, Wlan0) e
  • Create New...