buckboy223 Posted June 8, 2014 Share Posted June 8, 2014 I can't imagine this would be too difficult but it would be nice to have a SSL split infusion since ssltrip is fazing out ever since HSTs started becoming popular. Quote Link to comment Share on other sites More sharing options...
xrad Posted June 8, 2014 Share Posted June 8, 2014 (edited) I guess you could ssh into the mark v and see if it will install and work. I did see yours or someone's post on it. I did a quick search, xiaopan may have said it was openwrt compatible, not positive though. I wonder if this might be part of the coming mark v reboot in August. Probably it will be kind of hush hush, wink and nod until then, if it is. Who knows? Edited June 8, 2014 by xrad Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 2, 2014 Share Posted August 2, 2014 Soon Quote Link to comment Share on other sites More sharing options...
WPA3 Posted August 2, 2014 Share Posted August 2, 2014 I cannot wait for this, nice job. Quote Link to comment Share on other sites More sharing options...
cheeto Posted August 2, 2014 Share Posted August 2, 2014 Thx Whistle Master. i heard good things about this. It could be a game changer if it works. Cheers!! Quote Link to comment Share on other sites More sharing options...
Guest spazi Posted August 2, 2014 Share Posted August 2, 2014 Hehe Whistlemaster, I knew it was only a matter of time before you were going to make an infusion.Awesome stuff mate! Quote Link to comment Share on other sites More sharing options...
cheeto Posted August 3, 2014 Share Posted August 3, 2014 Just wondering, Will this be a solution to HSTS? Cheers Quote Link to comment Share on other sites More sharing options...
AlexJeb Posted August 3, 2014 Share Posted August 3, 2014 Awesome job whistlemaster. If you need a beta tester, let me know! Quote Link to comment Share on other sites More sharing options...
ARDETROYA Posted August 3, 2014 Share Posted August 3, 2014 Thanks for your excelent work whistle Master Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 3, 2014 Share Posted August 3, 2014 According to my latest tests.... it's working pretty good Quote Link to comment Share on other sites More sharing options...
m40295 Posted August 3, 2014 Share Posted August 3, 2014 the suspence for the new fw is killing me Quote Link to comment Share on other sites More sharing options...
Navras Posted August 3, 2014 Share Posted August 3, 2014 Also wondering if it brings a solution to HSTS. Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 4, 2014 Share Posted August 4, 2014 the suspence for the new fw is killing me This is not related to the new firmware. This is an new infusion for sslsplit. sslsplit is a transparent SSL/TLS proxy whereas ssltrip transparently converts a secure https connection into a plain HTTP connection, this is why web sites are now using hsts. sslsplit is really helpful during mobile application pentesting. Then, for sslsplit to work correctly and avoid warning on user-side, you need to install the certificate generated. Quote Link to comment Share on other sites More sharing options...
AlexJeb Posted August 4, 2014 Share Posted August 4, 2014 I don't suppose u have a date for the module release? Looking forward to it. Havent quite found the time to try it manually yet. Good job again with all the modules Whistlemaster Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 5, 2014 Share Posted August 5, 2014 (edited) Anyone for a beta test ? Send me a PM and a donation ! v1.0 is out. Edited August 10, 2014 by Whistle Master Quote Link to comment Share on other sites More sharing options...
ARDETROYA Posted August 6, 2014 Share Posted August 6, 2014 Anyone for a beta test ? Send me a PA ! I´ll wait for the 1.5... after that.... when ever you want! Quote Link to comment Share on other sites More sharing options...
warmotion Posted August 6, 2014 Share Posted August 6, 2014 make a video tutorial doing the implementation. ty bro. Quote Link to comment Share on other sites More sharing options...
Bl4ckc00k1e Posted August 8, 2014 Share Posted August 8, 2014 Sounds good, i will wait for testing :) Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 10, 2014 Share Posted August 10, 2014 v1.0 is out Quote Link to comment Share on other sites More sharing options...
ARDETROYA Posted August 10, 2014 Share Posted August 10, 2014 v1.0 is out Installing... Can´t wait to test it... Thank you Whistle Master for your work ;) Quote Link to comment Share on other sites More sharing options...
cheeto Posted August 10, 2014 Share Posted August 10, 2014 Hats off to you Whistle Master on not just for giving us sslsplit but also for updating the other infusions making them compatible with the current firmware. Regarding SSLsplit, Are there any instructions for this. Seems to be strait forward, but when I press the start button and go to gmail, hotmail, etc.. I get this message: Is there a workaround to this? As always, MANY MANY thanks! Quote Link to comment Share on other sites More sharing options...
ARDETROYA Posted August 10, 2014 Share Posted August 10, 2014 The log does split in undred of them. January 01 2014 06:04:10 [view | download | delete]January 01 2014 06:03:58 [view | download | delete]January 01 2014 06:03:07 [view | download | delete]January 01 2014 06:03:04 [view | download | delete]January 01 2014 06:02:59 [view | download | delete]January 01 2014 06:02:48 [view | download | delete]January 01 2014 06:02:31 [view | download | delete]January 01 2014 06:02:27 [view | download | delete]January 01 2014 06:02:23 [view | download | delete]January 01 2014 06:02:22 [view | download | delete] It would be cool to get all of them in just one. Quote Link to comment Share on other sites More sharing options...
Whistle Master Posted August 10, 2014 Share Posted August 10, 2014 (edited) Next release will have only one log file v1.1 has one log file per session. Edited August 11, 2014 by Whistle Master Quote Link to comment Share on other sites More sharing options...
ARDETROYA Posted August 10, 2014 Share Posted August 10, 2014 thank you Whistle Master! Quote Link to comment Share on other sites More sharing options...
King_Hrothgar Posted August 10, 2014 Share Posted August 10, 2014 (edited) Many thanks Whistle Master. Will grab it a little later tonight. Cheeto, that's how it works. It isn't like SSLstrip where it tries to simply remove SSL. Instead it has the attacker pretend to be the end user to the actual website and then applies its own encryption before passing on the data to the victim machine. This new encryption has a different set of keys and a different certificate. Unless you work for a real certificate authority (CA), you can't create automatically trusted certificates. As such, you have to make your own CA that obviously, no one even knows exists by default. To avoid messages like the one you got, you must add your new CA to the list of trusted CA's in your browser. It's fairly simple to do. Here's a link on how to do it (as well as use SSLsplit in general): http://blog.philippheckel.com/2013/08/04/use-sslsplit-to-transparently-sniff-tls-ssl-connections/#Create-and-install-root-CA-certificate Edited for typo's Edited August 11, 2014 by King_Hrothgar Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.