Re: [Full-disclosure] MiTM with https there are any tools ?

[Security Lists <securitylists@xxxxxxxxxxxxx>]

You can try DSNIFF  (http://www.monkey.org/~dugsong/dsniff/faq.html) but 
it will present a self-signed cert to the user.

I think you can use Achilles (http://www.digizen-security.com) and not 
even use SSL on the back half and the user might not notice.

-Mark C.




Alehandro Dias wrote:
> Hi,
>
> I need to conduct a test to get the unencrypted https traffic from a source,
> but dont know if there are any tools to do that.
> I am able to fake a dns entry, so he thinks i am www.hotmail.com (example).
>
> There are tools to setup a fake weserver (or proxy) that will redirect the
> queries to the true website, storing the clear data ?
> I imagine ettercap dont help in this situation.
>
> Thnx
>
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/