● Another tool for MITM attacks with basic but reliable features.

● Built-in sniffer.
● Supports plugins for dns spoofing ...etc.
● Supports custom filters.
● + more
 Bypassing HTTPS using SSLstrip

● Use ettercap as a spoofer and a basic sniffer.

● Run sslstrip manually to downgrade HTTPS requests to HTTP.

1. Flush iptables.
2. Add iptables rule to redirect packets to sslstrip.
3. Start sslstrip to downgrade https.
4. Start ettercap to poison target(s).
 Ettercap Plugins

● Ettercap has a number of plugins.

● Plugins can be used to:
○ Auto-add new clients → autoadd.
○ Re-poison clients after arp broadcasts → repoison_arp.
○ DNS spoof targets → dns_spoof.
○ + more.
 Typical Network

Requ
Hacker e sts Access Point

Resp
onse
s

q u ests
Re
Resources
Victim o n ses
Re sp eg:internet
 ARP Spoofing

Hacker I hav Access Point

e
mac victim’
add s
ress
I have the
router’s mac
address
Resources
Victim
eg:internet
 ARP Spoofing

Hacker Req Access Point

uest
s
Res
pon
ses
Responses
Requests

Resources
eg:internet

Victim
 One Way ARP Spoofing

Hacker Access Point

I have the
router’s mac
address
Resources
Victim
eg:internet