• python2
• scapy
• python2-nfqueue

How to:

• Run it as root.

  sudo python2 mitmer.py

• Select a network interface.
• After scanning the network for available hosts, choose one as a victim or enter an IP address manually.
• Select one of the attack profiles or custom.
• If custom is selected, type the domain(s) you want in the “Query request” field, and type the domain (or IP address) of the server that the victim should be redirected to in the “Query reply” field.
• Start the attack and wait.

• SSLsplit depends on the OpenSSL and libevent 2.x libraries.
• The build depends on GNU make and a POSIX.2 environment in `PATH`.
• The optional unit tests depend on the check library.

• FreeBSD: pf rdr and divert-to, ipfw fwd, ipfilter rdr
• OpenBSD: pf rdr-to and divert-to
• Linux: netfilter REDIRECT and TPROXY
• Mac OS X: ipfw fwd and pf rdr (experimental)

The first step in any Subterfuge attack is gaining a Man-in-the-Middle position. Currently, Subterfuge only ships with one method of establishing itself as MITM, ARP Cache Poisoning. Nevertheless, as a framework, its modular design allows it to support multiple methods.

Some used attacks

• ARP Cache Poisoning
• Dynamic Poison Retention & ARPBLock

List of some integrated modules

• Credential Harvester
• Session Hijacking
• HTTP Code Injection
• Denial of Service
• Tunnel Block
• Network View
• Evilgrade

• MITM sobre redes IPv4 con ARP Spoofing y DHCP ACK Injection.
• MITM sobre redes IPv6 con Neighbor Advertisement Spoofing, Ataque SLAAC, fake DHCPv6.
• DoS (Denegación de Servicio) sobre redes IPv4 con ARP Spoofing.
• DoS (Denegación de Servicio) sobre redes IPv6 con SLAAC DoS.
• DNS Hijacking.

Features

• Analyze HTTP(S) traffic on the fly
• Filter and highlight traffic, regex support included.
• Report Generation for saved flows, including a live JS editor.
• Save HTTP conversations for later analysis
• Make scripted changes with Python, e.g. remove Cache Header.
• based on and compatible to mitmproxy.
• cross-platform (Windows, OSX and Linux)
• SSL interception certs generated on the fly

Looking for more? Check out our GitHub wiki!

 

Quick Start

Download the latest release or pick a development snapshot.

Install all dependencies: pip install pyOpenSSL pyasn1 Twisted Autobahn
Windows users: Install the binaries for pyOpenSSL and Twisted manually (or compile yourself).
Ubuntu / Debian users: Install twisted as a package (sudo apt-get install python-twisted). If you get errors, check this page.

Start HoneyProxy with python honeyproxy.py or python honeyproxy.py --help.
If you don't use a modern browser, a kitten will die. We support both Firefox and Chrome!
Most command line parameters are documented in the mitmproxy docs.

•    FreeBSD: pf rdr, ipfw fwd, ipfilter rdr
•    OpenBSD: pf rdr
•    Linux: netfilter REDIRECT and TPROXY
•    Mac OS X: ipfw fwd

 Automated Man-in-the-Middle Attack Framework 



                                   
Abstract:  

Enter Subterfuge, a Framework to take the arcane art of Man-in-the-Middle Attack and make it as simple as point and shoot. A beautiful, easy to use interface which produces a more transparent and effective attack is what sets Subterfuge apart from other attack tools. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network, and even exploiting machines through race conditions. Now walk into a corporation… A rapidly-expanding portion of today’s Internet strives to increase personal efficiency by turning tedious or complex processes into a framework which provides instantaneous results.

On the contrary, much of the information security community still finds itself performing manual, complicated tasks to administer and protect their computer networks. Given the increase in automated hacking tools, it is surprising that a simplistic, “push-button” tool has not been created for information security professionals to validate their networks’ ability to protect against a Man-In-The-Middle attack. Subterfuge is a small but devastatingly effective credential-harvesting program which exploits a vulnerability in the Address Resolution Protocol. It does this in a way that a non-technical user would have the ability, at the push of a button, to harvest all of the usernames and passwords of victims on their connected network, thus equipping information and network security professionals with a “push-button” security validation tool.   


Download: http://code.google.com/p/subterfuge

Subterfuge DEFCON 20 Teaser:  http://www.youtube.com