DSploit

Advertisement

DSploit

After playing with the applications installed on the Pwn Pad, I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit. Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality.

The DSploit APK in the Play Store was not working for me, but the latest nightly on http://dsploit.net worked like a charm.

Most features require that you and your target uses the same WiFi network, and that's it. It can be Open, WEP, WPA/WPA2 Personal. On all of these networks, DSploit will sniff the passwords - because of the active attacks. E.g. a lot of email clients still use IMAP with clear text passwords, or some webmails, etc. 

First, DSploit lists the AP and the known devices on the network. In this case, I chose one victim client.


In the following submenu, there are tons of options, but the best features are in the MITM section. 


Stealthiness warning: in some cases, I received the following popup on the victim Windows:


This is what we have under the MITM submenu:


Password sniffing

For example, let's start with the Password Sniffer. It is the same as EvilAP and DSniff in my previous post. With the same results for the popular Hungarian webmail with the default secure login checkbox turned off. Don't forget, this is not an Open WiFi network, but one with WPA2 protection!


Session hijack

Now let's assume that the victim is very security-aware and he checks the secure login checkbox. Another cause can be that the victim already logged in, long before we started to attack. The session hijacking function is similar to the Firesheep tool, but it works with every website where the session cookies are sent in clear text, and there is no need for any additional support.

In a session hijacking attack (also called "sidejacking"), after the victim browser sends the authentication cookies in clear text, DSploit copies these cookies into its own browser, and opens the website with the same cookies, which results in successful login most of the time. Let's see session hijacking in action!

Here, we can see that the session cookies have been sniffed from the air:


Let's select that session, and be amazed that we logged into the user's webmail session.




Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.


Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.


Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip 

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:


HTML source on the client-side with SSL strip:


With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:
  1. Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
  2. Mark the session cookies with the secure flag
  3. Use HSTS to prevent SSLStrip attacks
If you are a user:
  1. Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
  2. Use HTTPS everywhere plugin
  3. For improved security, use VPN
Because hacking has never been so easy before.
And last but not least, if you like the DSploit project, don't forget to donate them!

Related links


  1. Hacker Security Tools
  2. Hacking Tools Software
  3. Hack Tool Apk
  4. Hacker Tools 2020
  5. Pentest Tools Download
  6. Hacking Tools Download
  7. Hacking Tools For Pc
  8. Hacker Tool Kit
  9. Hack Tools For Pc
  10. Hacker Tools List
  11. Hacker Tools For Windows
  12. Nsa Hack Tools Download
  13. Hacking Tools For Pc
  14. Pentest Tools Framework
  15. Pentest Recon Tools
  16. Hacking Tools Kit
  17. Pentest Tools Framework
  18. Hak5 Tools
  19. Hacker Tools Linux
  20. Hack Tools
  21. Hack Tools
  22. Hacker Tools Hardware
  23. Underground Hacker Sites
  24. Pentest Tools Url Fuzzer
  25. New Hacker Tools
  26. Hackers Toolbox
  27. Pentest Tools Review
  28. Pentest Tools Tcp Port Scanner
  29. Pentest Box Tools Download
  30. Hacker Tools Online
  31. Hacking Tools For Games
  32. Hacker Techniques Tools And Incident Handling
  33. Usb Pentest Tools
  34. Hacking Tools Pc
  35. Hacking Tools For Pc
  36. Hacking Tools Mac
  37. Hacker Tools 2019
  38. Underground Hacker Sites
  39. Pentest Automation Tools
  40. Pentest Tools Url Fuzzer
  41. Hacking Tools Online
  42. Hack Tools
  43. Pentest Tools Website
  44. Hacker Tools List
  45. Free Pentest Tools For Windows
  46. Hacking Tools Kit
  47. Hacking Tools For Pc
  48. Hacking Tools For Windows 7
  49. Pentest Tools Github
  50. Hacking Tools For Windows 7
  51. Hacking Tools For Windows 7
  52. Hack Tools 2019
  53. Pentest Tools Bluekeep
  54. Hack Tools For Ubuntu
  55. Pentest Tools Github
  56. Underground Hacker Sites
  57. Hacking Tools Software
  58. Hackers Toolbox
  59. Hack Tools Pc
  60. Pentest Tools Url Fuzzer
  61. Hacker Tools Online
  62. Pentest Tools Linux
  63. Pentest Tools Website Vulnerability
  64. Pentest Automation Tools
  65. Github Hacking Tools
  66. Pentest Tools Review
  67. Hack Tools For Ubuntu
  68. Pentest Tools Port Scanner
  69. Pentest Tools Windows
  70. Hackers Toolbox
  71. Hacker Tools For Windows
  72. Hacker Tools Apk Download
  73. Pentest Tools Review
  74. Hack Tools Mac
  75. Hacker Techniques Tools And Incident Handling
  76. Hacking Tools 2019
  77. Hacking Tools Name
  78. Github Hacking Tools
  79. Nsa Hacker Tools
  80. Hacking Tools Download
  81. Hacker Tools 2019
  82. New Hack Tools
  83. Hacking Tools For Windows Free Download
  84. Computer Hacker
  85. Pentest Tools Find Subdomains
  86. Install Pentest Tools Ubuntu
  87. Ethical Hacker Tools
  88. Hack Tools
  89. Pentest Reporting Tools
  90. Hacking Tools For Pc
  91. Hack Tools For Ubuntu
  92. Hack Tools 2019
  93. Hacking Tools Usb
  94. Hack Tool Apk
  95. Hacking Tools For Beginners
  96. Pentest Tools Apk
  97. Hacking Tools Windows 10
  98. Best Pentesting Tools 2018
  99. Hack App
  100. Hacker Tools Free
  101. Hacking Tools For Games
  102. Pentest Tools Android
  103. Hack Rom Tools
  104. Hacker Tools List
  105. Hacker
  106. Tools Used For Hacking
  107. Hack Tool Apk
  108. Hacker Techniques Tools And Incident Handling
  109. Hack Tools 2019
  110. Hacks And Tools
  111. Best Hacking Tools 2020
  112. Hacking Tools Name
  113. How To Install Pentest Tools In Ubuntu
  114. Underground Hacker Sites
  115. Hacker Tools Online
  116. Hack Tools Mac
  117. Hacking Tools For Windows
  118. Install Pentest Tools Ubuntu
  119. Install Pentest Tools Ubuntu
  120. Pentest Tools Open Source
  121. Install Pentest Tools Ubuntu
  122. Pentest Tools Download
  123. Pentest Tools For Android
  124. Hack App
  125. Black Hat Hacker Tools
  126. Hackers Toolbox
  127. Tools Used For Hacking
  128. Usb Pentest Tools
  129. Pentest Tools Online
  130. Hacking Tools For Windows Free Download
  131. Hacking Apps
  132. Pentest Recon Tools
  133. Termux Hacking Tools 2019
  134. Hacker Search Tools
  135. Hacking Tools For Mac
  136. Pentest Tools Online
  137. Hack Tools Online
  138. Hacking Tools Free Download
  139. Hack And Tools
  140. Hack App
  141. Hack Apps
  142. Nsa Hack Tools
  143. Hacker Tools Free Download
  144. Hacker Tools 2020
  145. Hack And Tools
  146. Hacking Tools For Kali Linux
  147. Hack Tools Download
  148. Hack Tools For Windows
  149. Hacking Tools Free Download
  150. Hack Tools
  151. Hacking Tools Download

Arsip Blog

Copyright © 2009 - - Kiamat | Coin Free Faucet Claim | Firebug Theme by Blog Oh! Blog | Converted to Blogger Template by ThemeLib.com | Jasa Promosi Online - Tukar Link Gratis