Travel Air Travel Sites Travel on the Cheap Travel for Cheap Travel One One Travel

DSploit

Password sniffing

Session hijack

Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.

Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.

Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip 

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:


HTML source on the client-side with SSL strip:


With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:

1. Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
2. Mark the session cookies with the secure flag
3. Use HSTS to prevent SSLStrip attacks

1. Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
2. Use HTTPS everywhere plugin
3. For improved security, use VPN