MITM to crack Https connections

Everybody knows that https is http over SSL, and https is a secure way for protecting confidential data like bank account/password ,etc. Now I'd to show you how to crack https connections by MITM(Man in the middle)

As you know that ARP is not a good mechanism...For example, the ip of workstation "Sales100" is 192.168.10.100. When the packet destination is 192.168.10.100, the Gateway will ask:"Who is 192.168.10.100"? Then Sales100 will rise his/her hand and say "it's me". What if I rise my hand first and pretend that I'm "192.168.10.100"? Those packets should send to workstation "Sales100" will send to my workstation first, and I could sniffer sales order, price, revenue ..it sounds scaring,right? That's MITM attack.

I use Ettercap and SSlStrip in the same time to make sure that I could get the password. Let's use Gmail for a simple test.

1.Run Ettercap and SSLStrip. The victim is 192.168.0.196.

 

2. Victim broswer will show warnings about certificate..Some users won't become aware of dangerous and will still proceed.

 

3. Victim starts to sign in Gmail

 

4.Keep an eye on the screen and you could see the Victim's username and password show up successfully.

 

Don't get me wrong. I'm not trying to encourage you to do MITM. I just show you how it works. There is only a fine line between Offense and Defense. Precise knowledge of self and precise knowledge of the threat leads to victory.