Rebroadcasting, using Karma & SSL Strip, and failing with Chrome logins

[oldtown]

Let me, properly, start my own thread (instead of hijacking).

Here's my setup: Wifi PineApple setup with PineApple juice 6800... wlan1 connected as client to public wifi and wlan0 rebroadcasting as AP... trying to MITM with Karma and SSL Strip running.

Here's my issue: it doesn't capture hardly ANYTHING!

I do some some entries enter SSL Strip's log (it's working)... it just will NOT strip the SSL from Facebook, Gmail, all sorts of useful sites!

The first video on uni.wifipineapple.com is VERY misleading - if not a downright scam.

Correct me if I'm wrong... but stripping SSL from Facebook is not possible on a current 'good' browser (especially an updated version of one that has accessed Facebook in the past) - right?

I see some benefits of the PA... it's still very neat... it would just be very NICE if the product was properly advertised. Maybe remove that useless video? It's kind of like... showing an advertisement for Sea World with trainers swimming with the killer whales..... when that's no longer allowed (but 1/2 the reason you went there, was because of that exact attraction).

Anyways.... can I do anything at all with mobile devices that are connected to Karma's SSID (they all use apps... so I assume no)... I know nothing about this side of things (can anyone shed some light or point me in the right direction)?

Seems a majority of my plans have been destroyed due to the way things REALLY are (not in a controlled advertisement environment).

(Hopefully this post isn't deleted... as these are legitimate concerns that I wish I'd known about before purchasing.)

[thesugarat]

Well the good news is the Hak5 team are very professional and will take good care of you no matter what you want to do...

The bad news is you're wrong and are not the only one that's tried to come here and complain about it after you bought a Pineapple. These guys make the hardware and firmware. They don't make SSL strip... they make a device that can run it. The fact that some websites out there (useful to you or not) are more proactive and plugged the security threat that SSL strip exposed is not the fault of Hak5. Karma is in the same realm but the Hak5 team is working on an updated firmware that will be released in the next few weeks that implements a newer approach. The computing/hacking landscape changes very quickly... Stop bitching and do your homework. People like you are the reason I hardly post here anymore.

[oldtown]

The Hak5 team is not blameless. They shamelessly still advertise their product by giving the impression (watch the video on uni.wifipineapple.com) that the PA can, as easily as Darren makes it look, capture Facebook passwords. False advertising... if you cannot see or accept that... you are choosing to turn a blind eye to it (or you have a financial interest in Hak5). I think my complaint about that was justified... and I am not alone.

Moving forward... you did not answer any of my questions. I'd happily listen to any advice and I'm more than happy to learn on my own... I'm just asking for a couple starting points/directions regarding the OP questions.

Have a great day!

[thesugarat]

I'm not going to debate this with you or anyone else. I believe you're logic is flawed and I have no financial interest is Hak5. Also, not the first time I've had to state that... As to your original question you might check out this new thread:

https://forums.hak5.org/index.php?/topic/33175-sslsplit-on-wifi-pineapple-mark-v/

[fringes]

The pineapple is a tool, a small computer with multiple interfaces and a simplistic UI with several "infusions" to get it to do all kinds of neat stuff. A pineapple is small enough (and cheap enough?) to leave discretely embedded behind a client's firewall during certain engagements. It can also be remotely and securely controlled even while it is behind a firewall.

The pineapple doesn't do anything you can't do with any other computer with the same software and interfaces. The tools it uses are all open source and avaliable on many other platforms. WRT the video you reference, It obviously worked when Darren recorded it, and I believe he ended with the following caveat:

"... There is of course technology that thwarts this like HSTS and you know it's a cat and mouse game like anything else and we're going to see some interesting developments as this continues, but for right now ..."

This is the world of information security and it is constantly changing. It's unfortuate for you that you jumped in while the one exploit that interested you is becoming less effective. Score one for defense! The pineapple is still useful for many other things, and there are reportedly changes on the horizon regarding Karma. I don't perceive any shameless advertising or misleading impressions in that video; I believe you misunderstood what you were watching. So Facebook (and browsers) finally cleaned up some of their most egregious vulnerabilities. But not everyone did, not by a long shot, and there's still plenty more where that came from.

I'm sure you can probably return your Mk5 to the hakshop for a refund, but is that one attack really all you bought it for? If so, you might not understand the legal implications of an MITM attack: If you MITM people without written permission from someone with the authority to grant it, that's illegal. So if that's your intent, it probably is better that you return it, ask for a refund, and get another hobby.

PS: If you do want to learn more and explore this and other tools, then stick around and read all you can including the link thesugarat provided.

Edited July 26, 2014 by fringes