M47H3W Posted February 1, 2016 Share Posted February 1, 2016 I am wondering if this would be possible. Lets say that I have a server in my home and it is properly port forwarded and everything which means that the website can be accessed outside of the network. My question is, if I am inside the same network as the server, is it possible to MITM that server so that when someone outside of the network logs in with the website, I can capture the login data? Quote Link to comment Share on other sites More sharing options...
sud0nick Posted February 1, 2016 Share Posted February 1, 2016 You would probably need to forward the port from your router to the attacker machine and then from there to the server. You could probably even write your own proxy server in C or Python to capture all of the traffic. Quote Link to comment Share on other sites More sharing options...
M47H3W Posted February 1, 2016 Author Share Posted February 1, 2016 (edited) You would probably need to forward the port from your router to the attacker machine and then from there to the server. You could probably even write your own proxy server in C or Python to capture all of the traffic. I can definitely edit the port forward settings, but will that disrupt the server/service if my attacker machine goes offline? Edited February 1, 2016 by M47H3W Quote Link to comment Share on other sites More sharing options...
sud0nick Posted February 1, 2016 Share Posted February 1, 2016 Yes, it would unless if you can figure out some way to provide a secondary route. You could probably do that on some higher grade switch but I don't think most home routers support that functionality. Quote Link to comment Share on other sites More sharing options...
Rainman_34 Posted February 1, 2016 Share Posted February 1, 2016 My question is probably rather silly but if it is your server on your network why wouldn't you just login to the database and get the login creditials from there? Quote Link to comment Share on other sites More sharing options...
i8igmac Posted February 1, 2016 Share Posted February 1, 2016 My question is probably rather silly but if it is your server on your network why wouldn't you just login to the database and get the login creditials from there? I was thinking the same thing.... if a person had access to the machine, u could configure the use of a proxy located on another machine... With out physical access to the web server, then mitm is necessary... you must then become the router... Quote Link to comment Share on other sites More sharing options...
M47H3W Posted February 2, 2016 Author Share Posted February 2, 2016 My question is probably rather silly but if it is your server on your network why wouldn't you just login to the database and get the login creditials from there? My goal is to capture the traffic without tampering with the server but with the network instead. Quote Link to comment Share on other sites More sharing options...
cooper Posted February 2, 2016 Share Posted February 2, 2016 Well, in the simplest of terms the router and the server are communicating within the local network and you want to MITM that. It really is that simple. So you ARP poison the router to get it to identify your machine as the one who has the real server's IP. Your biggest problem will be that out of all the machines on the network the one most likely to be hardened against ARP spoofing will be the router, simply because it, by virtue of the port forwarding setup and likely integration of IP mappings for fixed machines, is the definitive source for information on which mac has which IP address. Quote Link to comment Share on other sites More sharing options...
Bitbot17 Posted February 2, 2016 Share Posted February 2, 2016 (edited) i remember a program called cain & able (one of the coolest programs i ever used) back in the day it was easy to use you i just installed the program and you could get a lot of information on what was happening on the network, but that was like 5 years ago. not sure if it works today USE AT YOUR OWN RISK! Edited February 2, 2016 by Bitbot17 Quote Link to comment Share on other sites More sharing options...
i8igmac Posted February 2, 2016 Share Posted February 2, 2016 (edited) follow arpspoof tutorial... install the suite by apt-get install dsniff arpspoof 192.168.0.1 -t 192.168.0.111 arpspoof 192.168.0.111 -t 192.168.0.1 192.168.0.1= router 192.168.0.111=server enable ip forwarding on your distro. Then use some ip tables to control all traffic on port 80, 8080, 443 to a proxy like squid... learn it... Edited February 2, 2016 by i8igmac Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.