Introduction
This script will first force the user to logout from the site and when user will try to login again it will send the credentials to the server which is in our case is setup in server.py and by default localhost. This script is compatible with internet explorer only and make sure that internet explorer is not forwading you request to the microsoft Edge. TO DISABLE FORWARDING THE REQUEST TO EDGE ,FOLLOW BELOW STEPS : - Go to settings - then click on Default Browser present at left side in the List. - Then change Let Internet Explorer open sites in Microsoft Edge To NEVER
Lets walkthrough the code and learn how we can build script to perform mitb from scratch using python
You can also checkout other hacking scripts in this page hacking scripts
## Modifications :
By default this script will only get the credential of gmail and Facebook , But you can modify according to your need by appendng items in the list in mitb.py file.
## Working :
as soon as you will log-in or already logged In this script will force logout and then when you will start login again it will steal the creds and in default case send to the localhost.
##Pre-requisite :
Make sure both the scripts are running parallely!!!
Mitb.py##Libraries used #waiting for the DOM to fully load before allowing the rest of our script to keep executing #wait for browser to finish loading page #To recieve credentials from the target website #Note: change the port number 8080 if any issue arises due to port issues Dictionary of sites that are supported by this script ##EXTENDABLE## DICTIONARY-MEMBERS : - logout_url : URL we can redirect via a GET request to force user to logout - logout_form : is a DOM element that we can submit that forces logout - login_form_index : is the relative location in the target domain's DOM that contains the login form which we will modify - owned : flag that tells us if we have already captured credentials from a target site to avoid repitition ##DOM is Document Object model which is platform independent and treats the XML or HTML docs as a tree structure## using ClassId of internet explorer and instantiate the CMo object which gives us access to all tabs and instances of Internet explorer that are currently running ##COM is Component Object model allows inter process communication## Iterating through all currently running internet explorer objects includes active tabs If user is already visiting one of the sites in our dictionary then will start executing the main logic
Server.py##Libraries used #responsible for handling the HTTP POS requests #initialize the base TCPserver class with the IP,Port and CredRequesthandler class
Checkout some more hacking scripts
| SECURING SYSTEM | BLUETOOTH ATTACKS | STEALING AND SNIFFING ATTACKS | KALI LINUX HACKING COMMANDS CHEATSHEET | TROJAN AND BACKDOORS | DICTIONARY AND BURTEFORCING ATTACKS | MAN IN THE MIDDLE ATTACKS |
|---|---|---|---|---|---|---|
| 1. Sign & Verify message | 1. Bluetooth discovery | 1. Stealing saved wifi password from windows | 1. Hacking commands with Kali Linux | 1. Command and Control Trojan | 1. Dictionary Attack | 1. Man in Browser Attack |
| 2. SandBox Detection | 2. Bluetooth SDP browsing | 2. Sniffing packets | 2. Reverse shell in python | |||
| 3. TCP Proxy | 3. Bluetooth OBEX | 3. Email Credential sniffers | 3. Keylogger | |||
| 4. Bluetooth RCOMM channel scanner | 4. Screenshot with Python | |||||
| 5. Blue Bug Exploit | 5. Backdoor with Python | |||||
| 6. Blue Snarf Exploit | ||||||
| 7. Bluetooth spoofing | ||||||
| 8. Bluetooth sniffing |