Driftnet not picking any images from the target

Question

I'm trying to learn ethical hacking and I'm starting with ARP SPOOFING. I used driftnet but seems I can't get the images on my target. I'm running Kali Linux on VirtualBox and my target is my Windows machine. I'm connected to the same network. Can someone give me a clue why I can't get the images?

Details:

Router: 192.168.1.1
Target: 192.168.1.5
My IP: 192.168.1.7
VM Connection type: Bridged
Interface: eth0

Windows URL I am browsing on Google.

Google Images is probably using HTTPS, meaning the traffic is encrypted and an MitM attacker cannot see it. Have you tried a website that does not use HTTPS? — multithr3at3d, Mar 11 '18 at 05:16
Yes i tried it on http but no luck it's still cant get the images. — nethkennnnn, Mar 11 '18 at 05:18
What website did you try? If you open Wireshark, can you see any of the victim's traffic? Also, does that version of `arpspoof` support the `-r` flag? — multithr3at3d, Mar 11 '18 at 05:20
http://markinternational.info/ here's the site. Yes it is support `-r` flag sir. — nethkennnnn, Mar 11 '18 at 05:32
Can you capture *any* traffic from the target? Are you trying to capture the traffic of the *host* machine from the *VM*? — schroeder, Mar 11 '18 at 08:26
Be aware that you are not censoring your MAC address there, like at all. — forest, Mar 31 '18 at 07:32

Vinod Pn · Answer 1 · 2018-03-11T15:38:31.203

It's because you can only browse Google over https only and not http.Even if you force http, the response for that request will be a redirect to https.Along with the arpspoof, you will have to use a tool which will be a middle man doing the ssl handshake with the target's browser and Google. MITMproxy works great.There is still a catch though, the target's browser will flag the connection to be insecure, because MITMproxy will be using its own selfsigned certificate for handshake.Beacuse your other end is Google, target won't be able to add an exception in the browser and continue browsing because HSTS is set.To force the browsing, you will have to add MITMproxy's cert to the trustable root certificates manually in the browser.

Mitmproxy

How to use MITMPROXY

Edit: If you are seeing this problem for 'only' http connection too, check the Network settings for your bridge adapter in VirtualBox.You should set Promiscuous Mode to Allow All.

Check SSLstrip too, long time I used it.If it works, you will not need mitmproxy. — Vinod Pn, Mar 11 '18 at 08:51
This doesn't solve the specific problem, as the OP tested plain HTTP sites as well in the comments. We still don't know if OP can see any traffic at all either. — multithr3at3d, Mar 11 '18 at 15:00

Driftnet not picking any images from the target

1 Answers1