The beginners guide to breaking website security with nothing more than a Pineapple
web-securitywifimitmpacket-capturessl
Abstraction: Using WiFi Pineapple device to demonstrate MitM web security risks
Key points:
- WiFi Pineapple ($100 device) runs Jasager/"Yes Man" firmware on OpenWrt, acts as rogue access point
- Karma feature auto-responds to device probe requests for remembered SSIDs, luring victims without user action
- Wireshark on attacker's PC captures all victim traffic passing through the Pineapple's Ethernet tether
- Stack Overflow served auth cookies over plain HTTP at time of writing — captured trivially via packet filter
- tcpdump Infusion enables standalone packet capture on USB storage without needing a connected PC
- Demonstrates why loading login forms over HTTP (even posting to HTTPS) and mixed HTTP/HTTPS modes are exploitable
Connections: Troy Hunt · Wifi Pineapple · Wireshark · Web Security · Man In The Middle
Source: http://www.troyhunt.com/2013/04/the-beginners-guide-to-breaking-website.html?report