Friday, January 26, 2024

DSploit

DSploit

After playing with the applications installed on the Pwn Pad, I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit. Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality.

The DSploit APK in the Play Store was not working for me, but the latest nightly on http://dsploit.net worked like a charm.

Most features require that you and your target uses the same WiFi network, and that's it. It can be Open, WEP, WPA/WPA2 Personal. On all of these networks, DSploit will sniff the passwords - because of the active attacks. E.g. a lot of email clients still use IMAP with clear text passwords, or some webmails, etc. 

First, DSploit lists the AP and the known devices on the network. In this case, I chose one victim client.


In the following submenu, there are tons of options, but the best features are in the MITM section. 


Stealthiness warning: in some cases, I received the following popup on the victim Windows:


This is what we have under the MITM submenu:


Password sniffing

For example, let's start with the Password Sniffer. It is the same as EvilAP and DSniff in my previous post. With the same results for the popular Hungarian webmail with the default secure login checkbox turned off. Don't forget, this is not an Open WiFi network, but one with WPA2 protection!


Session hijack

Now let's assume that the victim is very security-aware and he checks the secure login checkbox. Another cause can be that the victim already logged in, long before we started to attack. The session hijacking function is similar to the Firesheep tool, but it works with every website where the session cookies are sent in clear text, and there is no need for any additional support.

In a session hijacking attack (also called "sidejacking"), after the victim browser sends the authentication cookies in clear text, DSploit copies these cookies into its own browser, and opens the website with the same cookies, which results in successful login most of the time. Let's see session hijacking in action!

Here, we can see that the session cookies have been sniffed from the air:


Let's select that session, and be amazed that we logged into the user's webmail session.




Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.


Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.


Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip 

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:


HTML source on the client-side with SSL strip:


With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:
  1. Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
  2. Mark the session cookies with the secure flag
  3. Use HSTS to prevent SSLStrip attacks
If you are a user:
  1. Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
  2. Use HTTPS everywhere plugin
  3. For improved security, use VPN
Because hacking has never been so easy before.
And last but not least, if you like the DSploit project, don't forget to donate them!

Continue reading


  1. Hacking Tools Free Download
  2. Bluetooth Hacking Tools Kali
  3. Game Hacking
  4. Wifi Hacker Tools For Windows
  5. Hacker Tools Mac
  6. Hacking Tools Download
  7. Hacking Tools Mac
  8. Tools Used For Hacking
  9. Pentest Tools Android
  10. Hacker Tools Hardware
  11. Hacking Tools
  12. Termux Hacking Tools 2019
  13. Hack App
  14. Hacking Tools Hardware
  15. Best Hacking Tools 2019
  16. Hack Tools Pc
  17. Ethical Hacker Tools
  18. Hacker Tool Kit
  19. Hacking Tools 2019
  20. Wifi Hacker Tools For Windows
  21. Hack Apps
  22. Nsa Hack Tools Download
  23. Hack Tools For Pc
  24. Hacking Tools Windows
  25. New Hacker Tools
  26. Hack Apps
  27. Pentest Automation Tools
  28. How To Install Pentest Tools In Ubuntu
  29. Hacking Tools For Windows Free Download
  30. Pentest Tools Nmap
  31. Termux Hacking Tools 2019
  32. Hacker Search Tools
  33. Nsa Hack Tools Download
  34. Hacking Tools Kit
  35. Hacking Tools For Windows
  36. Hack Tools Github
  37. Pentest Tools Subdomain
  38. Android Hack Tools Github
  39. Hacker Tools Free Download
  40. Android Hack Tools Github
  41. Pentest Tools Online
  42. Pentest Tools Framework
  43. Pentest Tools Download
  44. Hack App
  45. Beginner Hacker Tools
  46. Hacker Tools Online
  47. Pentest Tools Linux
  48. Pentest Tools For Windows
  49. Nsa Hack Tools
  50. Hacking Tools Kit
  51. Pentest Tools For Windows
  52. Hacking Tools For Beginners
  53. Hacking Tools Github
  54. Computer Hacker
  55. Easy Hack Tools
  56. Ethical Hacker Tools
  57. Pentest Tools Kali Linux
  58. Top Pentest Tools
  59. What Is Hacking Tools
  60. Physical Pentest Tools
  61. Hacker Tools Software
  62. Hacker Hardware Tools
  63. Hacking Tools And Software
  64. Hack Tools For Windows
  65. Hack Tools For Pc
  66. Hacker Tools Windows
  67. Hack Tools
  68. Hacker Techniques Tools And Incident Handling
  69. What Are Hacking Tools
  70. Hak5 Tools
  71. Hack Tools For Pc
  72. Pentest Automation Tools
  73. Hacking Tools Usb
  74. How To Make Hacking Tools
  75. Pentest Tools List
  76. Nsa Hack Tools Download
  77. How To Hack
  78. Pentest Tools Free
  79. Tools 4 Hack
  80. Pentest Tools Port Scanner
  81. Hacker Tools
  82. Hacker Tools Apk
  83. Hacker Tools Free Download
  84. Hacking Tools Software
  85. Hack App
  86. Easy Hack Tools
  87. Hacking Tools For Mac
  88. How To Install Pentest Tools In Ubuntu
  89. Hacker Tools 2020
  90. Tools 4 Hack
  91. Hacking Tools Pc
  92. Hacker Tools For Pc
  93. Hacker Tools Software
  94. Hacking Tools For Windows 7
  95. Hacker Tools Software
  96. Pentest Tools For Windows
  97. Pentest Tools For Mac
  98. Top Pentest Tools
  99. Pentest Tools Windows
  100. New Hacker Tools
  101. Pentest Tools Online
  102. Hacker Search Tools
  103. Beginner Hacker Tools
  104. Hacking Tools Free Download
  105. Pentest Tools Android
  106. Pentest Automation Tools
  107. Hacker Tools Software
  108. Hack App
  109. Hacking Tools Software
  110. Pentest Tools Find Subdomains
  111. Pentest Reporting Tools
  112. Pentest Tools For Mac
  113. Pentest Tools Github
  114. Hacking Tools Kit
  115. Pentest Tools Free
  116. Pentest Tools Online
  117. Hack Tools For Mac
  118. Hack App
  119. Hacking Tools For Kali Linux
  120. Android Hack Tools Github
  121. Hack Tools For Windows
  122. Tools For Hacker
  123. Pentest Tools Alternative
  124. Usb Pentest Tools
  125. Hacker Tools
  126. Hacking Tools For Windows 7
  127. Hack Tools For Ubuntu
  128. Tools Used For Hacking
  129. Hacking Tools Online
  130. Pentest Tools Nmap
  131. Top Pentest Tools
  132. Hacking Tools Windows
  133. Hacking Tools Name
  134. Hack Apps
  135. Hack Tools Mac
  136. Hacker Tools Free Download
  137. Hacking Tools
  138. Hacker Tools Online
  139. Pentest Tools Review
  140. Pentest Tools Kali Linux
  141. Hack Tools

No comments:

Post a Comment