MITM/HTTPS

Thinking more about how MITM attacks could be implemented against HTTPS, seeing if I can test any on the sandbox network at home.

So far, what have I tried?

• ARP spoofing works only against HTTP sites - using Bettercap works like a charm and it's easy to watch a sheep's HTTP traffic stream, but there's no tampering with HTTPS streams.
• DNS spoofing works only against HTTP sites - using Bettercap or Dnsspoof can spoof DNS requests (although it is not working correctly); they cannot spoof HTTPS requests
• SSLStrip is too old of an attack to work - many sites bypass it
• SSLSniff using Moxie0's suggested null-byte and other certificate attacks did not work - against an up-to-date browser... did not check any older ones.

Dead ends:

• ARP spoofing without a way to crack https
• DNS spoofing without a way to crack https
• Stealing private keys: getting private keys was just ridiculously stupidly impossible to actually do. Probably by design, but absolutely no way to learn that way.

Promising leads:

• SSLSniff allows you to serve up fake certificates - there are potential attacks on how browsers check certificates. This is one where you have to try throwing everything at the wall, until something sticks, and now all your sheep are all people who use that browser.
• CreatePEM - if RSA is weak enough, you can brute-force crack it: http://blog.stalkr.net/2010/03/codegate-decrypting-https-ssl-rsa-768.html