<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=245414417-06032006><FONT face=Arial color=#0000ff size=2>Try <A
href="http://www.oxid.it">www.oxid.it</A> instead</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV> </DIV><!-- Converted from text/plain format -->
<P><FONT size=2>Thank You<BR><BR>Rui Pereira,B.Sc.(Hons),CIPS
ISP,CISSP,CISA,CWNA<BR>Principal Consultant<BR><BR>WaveFront Consulting
Group<BR>Certified Information Systems Security Professionals<BR><BR><SPAN
class=245414417-06032006><A
href="mailto:wavefront1@shaw.ca">wavefront1</SPAN>@shaw.ca</A> | 1 (604) 961
0701<BR></FONT></P>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT
face=Tahoma size=2>-----Original Message-----<BR><B>From:</B>
full-disclosure-bounces@lists.grok.org.uk
[mailto:full-disclosure-bounces@lists.grok.org.uk] <B>On Behalf Of </B>Brendan
Dolan-Gavitt<BR><B>Sent:</B> March 6, 2006 8:51 AM<BR><B>To:</B>
full-disclosure@lists.grok.org.uk<BR><B>Subject:</B> Re: [Full-disclosure]
MiTM with https there are any tools ?<BR><BR></FONT></DIV>
<DIV>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Alehandro
Dias wrote:<BR>> Hi,<BR>><BR>> I need to conduct a test to get the
unencrypted https traffic from a source, <BR>> but dont know if there are
any tools to do that.<BR>> I am able to fake a dns entry, so he thinks i
am <A href="http://www.hotmail.com">www.hotmail.com</A>
(example).<BR>><BR>> There are tools to setup a fake weserver (or
proxy) that will redirect the <BR>> queries to the true website, storing
the clear data ?<BR>> I imagine ettercap dont help in this
situation.<BR></BLOCKQUOTE></DIV><BR>Cain & Abel can also do an SSL man in
the middle attack using ARP poisoning to trick the user into thinking you're
the destination server. Very point-and-click easy to use (though it looks like
<A href="http://oxid.it">oxid.it</A> is down at the moment). Of course, the
certs presented to the user will be invalid (unless you can get them to add
you as a trusted CA or something), but there's no way around that that I know
of.<BR><BR>-Brendan<BR></BLOCKQUOTE></BODY></HTML>