From: e247net (e247net@hotmail.com)
Date: Tue Aug 12 2003 - 02:38:08 EDT
Hi Chris
first i must thanks you for your interest in helping me.
I before I check further on webmitm.. I think my dnsspoofing is not working
correctly.
The file /etc/dnsspoof.hosts is as below:
+++++++++++++++++++++++++
192.168.93.133 *.yahoo.com
192.168.93.133 *.hotmail.com
192.168.93.133 mail.yahoo.com
192.168.93.133 www.yahoo.com
+++++++++++++++++++++++++++
Where victim is 192.168.93.131
Where attacker is 192.168.93.133
Where gateway is 192.168.93.2
Something confuse me, from the trace captured (when dns spoof is not
working) when victim request for
www.yahoo.com or mail.yahoo.com both the spoofed gateway(attacker)
and the actual gateway replied and the final
result from the command prompt of "nslookup www.yahoo.com"
return the actual IP of yahoo and not the spoofed IP (attacker IP)
which suppose to be.
By right, the actual gateway should not receive the
DNS query from victim since the attacker has intecepted (arp spoofed)
>From trace this seems not to be the case, the query went
to the spoofed gateway first and it perform a ICMP redirect
and tells victim the actual gateway IP and resulted both
spoofed and actual gateway replied. And, final result
pick the actual IP -- thus spoofing failed.
Any hints??
THanks
----- Original Message -----
From: "Christine Kronberg" <Christine_Kronberg@genua.de>
To: "e247net" <e247net@hotmail.com>
Cc: <pen-test@securityfocus.com>
Sent: Monday, August 11, 2003 9:41 PM
Subject: Re: webmitm
>
> Hi,
>
>
> > i started with webmitm -dd and see only all the GET requests from
"victim"
>
> If I understand the source code correctly than this is exactly what
> it is supposed to do (please correct me, if I'm wrong). webmitm is a
> demonstration for sniffing sensitive data like passwords or similar
> things. The victim is putting this data either in a GET request - so
> you only need to read enough of the data to fetch the complete GET
> request - or the data sits in the http header data when using a POST
> request. I can get both working, but when submitting the data via POST,
> I only see the data using lynx and forcing it to a hard exit. That
> takes a lot of charm from a demonstration (well, usually the GET
> part is enough ;-) ).
>
> > but no traffic from real site back .
> >
> > victim -- > attacker ---> real site
> >
> > Btw, i found out that my dnsspoof is working intermittently... thought i
put
> > www.hotmail.com and mail.yahoo.com in
> > the dnsspoof.hosts file but only mail.yahoo.com is being spoofed and not
> > www.hotmail.com.. any help plse
>
> You entered both correctly into your spoofed-hosts file, I presume?!
> What does dnsspoof say, wenn a request for hotmail.com comes by? Is
> it ignored?
>
> Regards,
>
>
> Chris Kronberg.
>
> --
> GeNUA mbH
>
>
>
> --------------------------------------------------------------------------
-
> --------------------------------------------------------------------------
-- > > > --------------------------------------------------------------------------- ----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:38 EDT