How Do I Sniff For Passwords

[Hamster]

Hi, how would I sniff https passwords using the nano? I had a mark 4 a while back and I didnt have much success. Also, how would I get the client to connect to the pineapple if they are already connected to a network. Thanks!

[Foxtrot]

If the traffic is encrypted with SSL but does not use HSTS (or some other enforcement), you could try SSLSplit.

If the SSL uses HSTS (Which it likely does) you cannot.

[Hamster]

How do I check to see if the site uses HSTS and if it does, is there another way to do it?

[Foxtrot]

https://www.ssllabs.com/ssltest/analyze.html

https://hsts.realloc.me/

 

You can do things like installing your own CA on the target device, etc.

Edited August 23, 2016 by Foxtrot

[Hamster]

Thanks, okay the site that I tested on ssllabs, it says HSTS no and HSTS preloading not in chrome, edge, firefox, ie, and tor so I assume this will work? Thanks

Edited August 23, 2016 by ArcticWolf_11
added details

[kaifanos]

On 23/8/2016 at 1:11 PM, Foxtrot said:

https://www.ssllabs.com/ssltest/analyze.html

https://hsts.realloc.me/

 

You can do things like installing your own CA on the target device, etc.

 is there any way to install the CA from the EvilPortal?

Thanks!