Penetration Testing: Re: [PEN-TEST] Forge name-query?

From: Dug Song <dugsong_at_MONKEY.ORG>
Date: Mon, 27 Nov 2000 01:53:36 -0500

On Sun, Nov 26, 2000 at 03:52:07PM -0500, Mordechai Ovits wrote:

> > sshmitm
>
> Won't the user get a warning about host not matching the key in known_hosts?

of course. and how do you think most users respond? :-)

> > webmitm
>
> Won't the browser pop up an error about the certificate not matching the
> site? Or not signed by a known CA?

see above. my test webmitm cert for www.hotmail.com is signed by
"Hotmail, Inc." - sound believable to you? :-)

> Cool, what else?

msgsnarf is finished as well, for those who asked.

and i'm still working on a generic TCP MITM program that uses the BSD
tunnel device to deliver hijacked connections to the local stack for
handling by custom daemons, but i'm not releasing it, at least not any
time soon. sorry.

that is all.

-d.

---
http://www.monkey.org/~dugsong/

Received on Nov 28 2000