Hello everyone, I'm Ryu. I will tell you how to spy on the network and how to bypass the HTTPS to the HTTP protocol

[REPLY]

First, you need the ettercap tool, please install it according to your OS, I assume you have finished installing it

Second, you have to install a file with a .py extension, this is used to bypass
(https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/examples/contrib/sslstrip.py)
download it!

you should check the IPv4 network and default gateway, if you are using the windows operating system, you can type this in your command prompt:

$ ipconfig

or you can choose another option by using Ettercap with the Graphical User Interface (GUI) version

you can set the network you use, here I use wlo1, after you make sure everything is correct, you can press the check button above right.

you can press the three dots above there then select the option "hosts"

after that, you can continue to press the "scan for hosts" option

if successful then ettercap will print like so, ettercap found 2 hosts on my network.

you can press the button to the right of the search logo up there to see the IP address of the host in question, like this:

after that, you can press the option "Add to target1" or "Add target2". Since I have 2 hosts in my network then I will add both hosts as sniffing targets

after that ettercap will print a warning that that host has been added as a target

you can continue pressing the world logo on the top right, those are some sniffing target menus on ettercap

please select the "ARP Poisoning", this option will get you results when the target sends a POST request to the website he visits.

You need to open your favorite terminal, of course, I use a Debian-based Linux terminal here.

You can allow your terminal to enter "root" mode by typing

$ sudo su

then you can type commands like this

$ ettercap -Tq -M arp:remote -i wlo1 -S /[Default Gateway]// /[Target IP]//

$ mitmdump -s '/home/ryu/sslstrip.py' -m transparent

$ iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 8080

you can modify the command above, such as changing the sslstrip.py file location page or filling in the default gateway IP along with the target IP that you already know.

For example, there I open the linuxploit.com website, it shows that my browser redirects the website to the HTTP protocol instead of HTTPS, it happens because I typed "linuxploit.com" without HTTPS:// in the address bar, not all websites can be bypassed.

Websites like Facebook, Google or others will not be bypassed because they are protected by HSTS.[/REPLY]